Windows Analysis Report
dllhost.exe

Overview

General Information

Sample name: dllhost.exe
Analysis ID: 1428961
MD5: 2fc802ab965a8ea49c5611eac53b925a
SHA1: 04dbddc0bf777077f1834085c79cb38d556eb2f2
SHA256: 57cb9051d4709e33fb38ec9e9170878e1f952f3180b75b00e030c378d55235ce
Infos:

Detection

LockBit ransomware
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found ransom note / readme
Malicious sample detected (through community Yara rule)
Yara detected LockBit ransomware
Changes the wallpaper picture
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Deletes itself after installation
Found Tor onion address
Found evasive API chain (may stop execution after checking mutex)
Found potential ransomware demand text
Hides threads from debuggers
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Overwrites Mozilla Firefox settings
Sigma detected: System File Execution Location Anomaly
Tries to harvest and steal browser information (history, passwords, etc)
Writes many files with high entropy
Writes to foreign memory regions
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Enables debug privileges
Enables security privileges
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Potentially Suspicious Desktop Background Change Via Registry
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: dllhost.exe Avira: detected
Machine Learning detection for sample
Source: dllhost.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: dllhost.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Videos\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Searches\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Saved Games\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Recent\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Pictures\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Pictures\Saved Pictures\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Pictures\Camera Roll\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\OneDrive\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Music\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Links\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Favorites\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Favorites\Links\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Downloads\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\ZGGKNSUKOP\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\VWDFPKGDUF\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\UNKRLCVOHV\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\TQDFJHPUIU\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\SNIPGPPREP\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\Outlook Files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\KLIZUSIQEN\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\EOWRVPQCCS\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\DUUDTUBZFW\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\CZQKSDDMWR\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\ZGGKNSUKOP\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\VWDFPKGDUF\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\UNKRLCVOHV\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\TQDFJHPUIU\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\SNIPGPPREP\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\KLIZUSIQEN\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\EOWRVPQCCS\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\DUUDTUBZFW\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\CZQKSDDMWR\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Contacts\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\to-be-removed\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\temporary\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionstore-backups\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\security_state\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\minidumps\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\tmp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\events\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\db\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\crashes\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\crashes\events\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\bookmarkbackups\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\m8f4v4pw.default\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Headlights\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\a8578cfd-76c6-4d8c-b5cf-76b4c5e3ac6b\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\VirtualStore\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\{12D753DB-DED8-4673-9841-1F22083226EE}\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\VBE\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_3412_1715673340\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_3188_434848908\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Low\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_968483001\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_944194922\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_863982884\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_794381239\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_530746050\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_471632188\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_465642094\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_357048388\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_243013742\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_2099027583\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_2069604627\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_2017517930\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1623700211\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1451159892\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1423642920\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1244100889\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1202679133\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1151647528\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrocef_low\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\SolidDocuments\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Publishers\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\PeerDistRepub\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ca8e2f5b-10d2-46de-ab48-fe4a97755e77}\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: dllhost.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\xUSdFhL29.README.txt ' source: dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.xUSdFhL29xt source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1251339725.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\xUSdFhL29.README.txtp?~ source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1251339725.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1257074503.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.xUSdFhL29 source: dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.xUSdFhL29n' source: dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1263356381.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1256528513.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1260962935.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\USdFhL29.README.txt source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\F" source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1263356381.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1256528513.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1260962935.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\xUSdFhL29.README.txt source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1260962935.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1256528513.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: C:\ProgramData\92D9.tmp Code function: 12_2_0040227C FindFirstFileExW, 12_2_0040227C
Source: C:\ProgramData\92D9.tmp Code function: 12_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose, 12_2_0040152C
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\ Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\ Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\ Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\ Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\ Jump to behavior

Networking
barindex
Found Tor onion address
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionina
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onione&
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onional
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionl
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion^
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionalM
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionx
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion]
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion]
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion1
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionl,
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onioned
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionHC
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy
Source: dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
Source: dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
Source: dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt.uz
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion22-4DB4-AC8E-4E1DDDE828FE_cw5n1
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionina
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onional
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onione&
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionl
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion1
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionHC
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionalM
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onioned
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionl
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionx
Source: dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupp.uz
Source: icudtl.dat.xUSdFhL29.1.dr String found in binary or memory: http://www.unicode.org/copyright.html
Source: bn.pak.xUSdFhL29.1.dr String found in binary or memory: https://chrome.google.com/webstore?hl=bn&category=theme81https://myactivity.google.com/myactivity/?u
Source: hi.pak.xUSdFhL29.1.dr String found in binary or memory: https://chrome.google.com/webstore?hl=hi&category=theme81https://myactivity.google.com/myactivity/?u
Source: ru.pak.xUSdFhL29.1.dr String found in binary or memory: https://chrome.google.com/webstore?hl=ru&category=theme81https://myactivity.google.com/myactivity/?u
Source: dllhost.exe, 00000001.00000003.1410010413.000000000138C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=th
Source: th.pak.xUSdFhL29.1.dr String found in binary or memory: https://chrome.google.com/webstore?hl=th&category=theme81https://myactivity.google.com/myactivity/?u
Source: dllhost.exe, 00000001.00000003.1410010413.000000000138C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=trK
Source: dllhost.exe, 00000001.00000003.1410010413.000000000138C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=uk
Source: uk.pak.xUSdFhL29.1.dr String found in binary or memory: https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u
Source: dllhost.exe, 00000001.00000003.1416285727.00000000046E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr String found in binary or memory: https://myactivity.google.com/
Source: dllhost.exe, 00000001.00000003.1416285727.00000000046E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, th.pak.xUSdFhL29.1.dr String found in binary or memory: https://passwords.google.com
Source: hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr String found in binary or memory: https://passwords.google.comGoogle
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr String found in binary or memory: https://policies.google.com/
Source: dllhost.exe, 00000001.00000003.1408706397.000000000125B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1416285727.00000000046E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, uk.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr, ru.pak.xUSdFhL29.1.dr, fa.pak.xUSdFhL29.1.dr, th.pak.xUSdFhL29.1.dr String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: dllhost.exe, 00000001.00000003.1408706397.000000000125B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1416285727.00000000046E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, uk.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr, ru.pak.xUSdFhL29.1.dr, fa.pak.xUSdFhL29.1.dr, th.pak.xUSdFhL29.1.dr String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: dllhost.exe, 00000001.00000003.1410010413.000000000138C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: dllhost.exe, 00000001.00000003.1222047576.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1222047576.00000000012DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.oGUCFCdKfd-E
Source: dllhost.exe, 00000001.00000003.1623107102.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tox.ch
Source: dllhost.exe, 00000001.00000003.1623107102.0000000001235000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1211501555.0000000001238000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1220039729.000000000121F000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1211501555.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1623107102.000000000123A000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1623107102.0000000001238000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1220039729.000000000122E000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1625597855.0000000001236000.00000004.00000020.00020000.00000000.sdmp, xUSdFhL29.README.txt303.1.dr, xUSdFhL29.README.txt384.1.dr, xUSdFhL29.README.txt193.1.dr, xUSdFhL29.README.txt355.1.dr, xUSdFhL29.README.txt473.1.dr, xUSdFhL29.README.txt226.1.dr, xUSdFhL29.README.txt148.1.dr, xUSdFhL29.README.txt119.1.dr, xUSdFhL29.README.txt43.1.dr, xUSdFhL29.README.txt448.1.dr, xUSdFhL29.README.txt404.1.dr, xUSdFhL29.README.txt198.1.dr String found in binary or memory: https://tox.chat
Source: dllhost.exe, 00000001.00000003.1222047576.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1222047576.00000000012DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.c0yfKF26qNRb
Source: dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.w0HgyL2ZPBj2
Source: dllhost.exe, 00000001.00000003.1222047576.00000000012E4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: dllhost.exe, 00000001.00000003.1222047576.00000000012E4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Spam, unwanted Advertisements and Ransom Demands
barindex
Found ransom note / readme
Source: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Dropped file: >>>> Your data are stolen and encrypted!>>>> Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Your competitors or law enforcement may get them on the web.Data includes:- Employees personal data, CVs, DL, SSN.- Complete network map including credentials for local and remote services.- Financial information including clients data, bills, budgets, annual reports, bank statements.- Complete datagrams/schemas/drawings for manufacturing in solidworks format- And more...You can request the tree of files that we have.>>>> You need contact us and decrypt one file for free, send a small file for test decryption with your personal DECRYPTION ID to tox chat:>>>> Your personal DECRYPTION ID: A96FA3AD1739CBD80C7E9E83972951361)Download and install TOX chat: https://tox.chat2)Write to this tox id: DED25DCB2AAAF65A05BEA584A0D1BB1D55DD2D8BB4185FA39B5175C60C8DDD0C0A7F8A8EC815 and wait for the answer, we will always answer you.>>>> DO NOT MODIFY FILES YOURSELF.>>>> DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA.>>>> YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS.>>>> YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. Jump to dropped file
Yara detected LockBit ransomware
Source: Yara match File source: dllhost.exe, type: SAMPLE
Source: Yara match File source: 1.0.dllhost.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000000.1205884284.0000000000CE1000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dllhost.exe PID: 6536, type: MEMORYSTR
Changes the wallpaper picture
Source: C:\Users\user\Desktop\dllhost.exe Key value created or modified: HKEY_CURRENT_USER\Control Panel\Desktop WallPaper C:\ProgramData\xUSdFhL29.bmp Jump to behavior
Found potential ransomware demand text
Source: dllhost.exe, 00000001.00000003.1623107102.0000000001235000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : All your important files are stolen and encrypted!
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : Your data are stolen and encryptedr
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : Your data are stolen and encrypted
Source: dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : Your data are stolen and encrypted
Source: dllhost.exe, 00000001.00000003.1211501555.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: dllhost.exe, 00000001.00000003.1623107102.000000000123A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: dllhost.exe, 00000001.00000003.1623107102.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: dllhost.exe, 00000001.00000003.1220039729.000000000122E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: dllhost.exe, 00000001.00000002.1625597855.0000000001236000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt303.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt384.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt193.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt355.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt473.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt226.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt148.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt119.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt43.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt448.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt404.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt198.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt360.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt299.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt496.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt372.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt262.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt485.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt96.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt67.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt510.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt281.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt333.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt69.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt77.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt407.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt110.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt13.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt65.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt192.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt445.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt513.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt215.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt204.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt223.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt33.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt311.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt86.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt181.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt206.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt64.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt352.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt481.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt49.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt100.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt216.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt420.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt191.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt106.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt285.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt98.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt450.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt80.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt424.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt354.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt336.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt302.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt85.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt183.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt59.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt331.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt512.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt243.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt194.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt229.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt24.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt489.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt146.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt488.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt435.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt459.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt416.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt178.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt116.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt22.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt335.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt166.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt497.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt197.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt141.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt257.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt169.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt99.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt162.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt415.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt217.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt188.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt444.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt345.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt290.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt288.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt47.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt205.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt102.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt7.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt409.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt482.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt145.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt202.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt490.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt196.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt219.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt21.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt143.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt508.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt329.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt16.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt74.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt495.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt39.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt378.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt41.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt343.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt124.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt339.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt417.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt477.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt436.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt171.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt362.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt258.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt318.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt309.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt521.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt38.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt325.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt153.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt1.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt425.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt462.1.dr String found in binary or memory : >>>> Your data are stolen and encrypted!
Modifies existing user documents (likely ransomware behavior)
Source: C:\Users\user\Desktop\dllhost.exe File moved: C:\Users\user\Desktop\EOWRVPQCCS\EOWRVPQCCS.docx Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File moved: C:\Users\user\Desktop\EOWRVPQCCS\QCOILOQIKC.png Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File moved: C:\Users\user\Desktop\DUUDTUBZFW\ZGGKNSUKOP.pdf Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File moved: C:\Users\user\Desktop\EOWRVPQCCS.docx Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File moved: C:\Users\user\Desktop\ZGGKNSUKOP\GIGIYTFFYT.xlsx Jump to behavior
Writes many files with high entropy
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8ABD94FB-E7D6-84A6-A997-C918EDDE0AE5}.xUSdFhL29 entropy: 7.99553551231 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E8B84CFB-B069-BC13-F88F-170904F645E5}.xUSdFhL29 entropy: 7.99556584331 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E7A33582-E908-3379-5368-5999454DCD83}.xUSdFhL29 entropy: 7.99475098923 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{DAA168DE-4306-C8BC-8C11-B596240BDDED}.xUSdFhL29 entropy: 7.99497345658 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C804BBA7-FA5F-CBF7-8B55-2096E5F972CB}.xUSdFhL29 entropy: 7.99539002059 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C1C6F8AC-40A3-0F5C-146F-65A9DC70BBB4}.xUSdFhL29 entropy: 7.99518974927 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BD3F924E-55FB-A1BA-9DE6-B50F9F2460AC}.xUSdFhL29 entropy: 7.99559379399 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BB044BFD-25B7-2FAA-22A8-6371A93E0456}.xUSdFhL29 entropy: 7.99563042932 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{923DD477-5846-686B-A659-0FCCD73851A8}.xUSdFhL29 entropy: 7.99470287126 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{F1118828-A0CC-5FEB-85C9-DBFFDF98434A}.xUSdFhL29 entropy: 7.99507860371 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_lync_exe_15.xUSdFhL29 entropy: 7.99463090755 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_EXCEL_EXE_15.xUSdFhL29 entropy: 7.9948334958 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_DATABASECOMPARE_EXE_15.xUSdFhL29 entropy: 7.99527576102 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_InternetExplorer_Default.xUSdFhL29 entropy: 7.99587739604 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_WINWORD_EXE_15.xUSdFhL29 entropy: 7.99534793371 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SPREADSHEETCOMPARE_EXE_15.xUSdFhL29 entropy: 7.99484852028 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15.xUSdFhL29 entropy: 7.99394017495 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_POWERPNT_EXE_15.xUSdFhL29 entropy: 7.99520538385 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OUTLOOK_EXE_15.xUSdFhL29 entropy: 7.99469152675 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_ONENOTE_EXE_15.xUSdFhL29 entropy: 7.99495068696 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OcPubMgr_exe_15.xUSdFhL29 entropy: 7.99516022908 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSPUB_EXE_15.xUSdFhL29 entropy: 7.99441396952 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_msoev_exe_15.xUSdFhL29 entropy: 7.99494699218 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSACCESS_EXE_15.xUSdFhL29 entropy: 7.99566558585 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsSoundRecorder_8wekyb3d8bbwe!App.xUSdFhL29 entropy: 7.99454063868 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsCalculator_8wekyb3d8bbwe!App.xUSdFhL29 entropy: 7.99507316906 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsAlarms_8wekyb3d8bbwe!App.xUSdFhL29 entropy: 7.99521379801 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Shell_RunDialog.xUSdFhL29 entropy: 7.99461584098 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_RemoteDesktop.xUSdFhL29 entropy: 7.99506534498 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_MediaPlayer32.xUSdFhL29 entropy: 7.99463110678 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer.xUSdFhL29 entropy: 7.99530358242 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.xUSdFhL29 entropy: 7.99263952814 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel.xUSdFhL29 entropy: 7.99500833191 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Computer.xUSdFhL29 entropy: 7.99498780193 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_AdministrativeTools.xUSdFhL29 entropy: 7.99470234894 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_magnify_exe.xUSdFhL29 entropy: 7.99508098397 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_iscsicpl_exe.xUSdFhL29 entropy: 7.99513446794 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_dfrgui_exe.xUSdFhL29 entropy: 7.99503049128 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.xUSdFhL29 entropy: 7.99486588957 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cmd_exe.xUSdFhL29 entropy: 7.99473586322 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cleanmgr_exe.xUSdFhL29 entropy: 7.99541501251 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe.xUSdFhL29 entropy: 7.99603282013 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MSEdge.xUSdFhL29 entropy: 7.9951752922 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_quickassist_exe.xUSdFhL29 entropy: 7.99531300358 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_psr_exe.xUSdFhL29 entropy: 7.99548876574 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_printmanagement_msc.xUSdFhL29 entropy: 7.99419602813 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_osk_exe.xUSdFhL29 entropy: 7.99462575651 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_odbcad32_exe.xUSdFhL29 entropy: 7.99492062485 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_notepad_exe.xUSdFhL29 entropy: 7.99513330615 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_narrator_exe.xUSdFhL29 entropy: 7.99538189421 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_mspaint_exe.xUSdFhL29 entropy: 7.99503537871 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msinfo32_exe.xUSdFhL29 entropy: 7.99487625503 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msconfig_exe.xUSdFhL29 entropy: 7.99515146495 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_MdSched_exe.xUSdFhL29 entropy: 7.99527138215 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe.xUSdFhL29 entropy: 7.99479575192 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Common Files_Microsoft Shared_Ink_mip_exe.xUSdFhL29 entropy: 7.99438466166 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Adobe_Acrobat DC_Acrobat_Acrobat_exe.xUSdFhL29 entropy: 7.9948876485 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7zFM_exe.xUSdFhL29 entropy: 7.99495848911 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7-zip_chm.xUSdFhL29 entropy: 7.99580555428 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.xUSdFhL29 entropy: 7.9948861217 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_powershell_exe.xUSdFhL29 entropy: 7.99586725334 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WF_msc.xUSdFhL29 entropy: 7.99438996242 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WFS_exe.xUSdFhL29 entropy: 7.9951698529 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_services_msc.xUSdFhL29 entropy: 7.99493845649 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_RecoveryDrive_exe.xUSdFhL29 entropy: 7.99533255092 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_x64_exe.xUSdFhL29 entropy: 7.99572912118 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_exe.xUSdFhL29 entropy: 7.99512793214 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Examples.xUSdFhL29 entropy: 7.99473391701 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt_chm.xUSdFhL29 entropy: 7.99446635235 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoItX_AutoItX_chm.xUSdFhL29 entropy: 7.99553894123 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_x64_exe.xUSdFhL29 entropy: 7.99497709656 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_exe.xUSdFhL29 entropy: 7.99491541684 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt v3 Website_url.xUSdFhL29 entropy: 7.99451163228 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_x64_exe.xUSdFhL29 entropy: 7.99496637456 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_exe.xUSdFhL29 entropy: 7.99516004523 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Windows NT_Accessories_wordpad_exe.xUSdFhL29 entropy: 7.995971329 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.xUSdFhL29 entropy: 7.99606599199 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.xUSdFhL29 entropy: 7.99447634417 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.xUSdFhL29 entropy: 7.99586379651 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.xUSdFhL29 entropy: 7.9942954033 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.xUSdFhL29 entropy: 7.99666849701 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.xUSdFhL29 entropy: 7.99415670388 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.xUSdFhL29 entropy: 7.99626735225 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.xUSdFhL29 entropy: 7.99448541676 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.xUSdFhL29 entropy: 7.99669074969 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.xUSdFhL29 entropy: 7.99492193692 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.xUSdFhL29 entropy: 7.99482605772 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\4543e2b6-0dac-4484-972e-233c4ffdcfcd.xUSdFhL29 entropy: 7.99701000058 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\59f06e22-78e3-4143-9d34-bd19d6977013.xUSdFhL29 entropy: 7.9972821019 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\c52da37e-6215-4698-a8c6-7dbc7928eb26.xUSdFhL29 entropy: 7.99551475438 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-shm.xUSdFhL29 entropy: 7.99412412959 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\chrome_100_percent.pak.xUSdFhL29 entropy: 7.99669052924 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\resources.pak.xUSdFhL29 entropy: 7.99786830114 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\VisualElements\Logo.png.xUSdFhL29 entropy: 7.99378615534 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\cs.pak.xUSdFhL29 entropy: 7.99969082456 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\af.pak.xUSdFhL29 entropy: 7.99954557172 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\en-GB.pak.xUSdFhL29 entropy: 7.99954262157 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\da.pak.xUSdFhL29 entropy: 7.99957759921 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\de.pak.xUSdFhL29 entropy: 7.99966988593 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\ca.pak.xUSdFhL29 entropy: 7.9996440153 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\en-US.pak.xUSdFhL29 entropy: 7.99950767749 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\et.pak.xUSdFhL29 entropy: 7.99957473469 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\es-419.pak.xUSdFhL29 entropy: 7.99962747439 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\es.pak.xUSdFhL29 entropy: 7.99958020919 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\fil.pak.xUSdFhL29 entropy: 7.9996676207 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\fr.pak.xUSdFhL29 entropy: 7.99965366385 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\fi.pak.xUSdFhL29 entropy: 7.99959503141 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\it.pak.xUSdFhL29 entropy: 7.99965983732 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\hu.pak.xUSdFhL29 entropy: 7.99963591233 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\hr.pak.xUSdFhL29 entropy: 7.99959680503 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.xUSdFhL29 entropy: 7.99851844453 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{F38BF404-1D43-42F2-9305-67DE0B28FC23}_regedit_exe.xUSdFhL29 entropy: 7.99495099642 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.xUSdFhL29 entropy: 7.99546721949 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_powershell_exe.xUSdFhL29 entropy: 7.99481675453 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_odbcad32_exe.xUSdFhL29 entropy: 7.99456006825 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Java_jre-1_8_bin_javacpl_exe.xUSdFhL29 entropy: 7.99517884114 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_SciTE_SciTE_exe.xUSdFhL29 entropy: 7.99385782675 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Extras.xUSdFhL29 entropy: 7.99485070195 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log.xUSdFhL29 entropy: 7.99963801826 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs.xUSdFhL29 entropy: 7.99964979124 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs.xUSdFhL29 entropy: 7.99963083943 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log.xUSdFhL29 entropy: 7.99960539851 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.xUSdFhL29 entropy: 7.99341467911 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\id.pak.xUSdFhL29 entropy: 7.99959726499 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\ko.pak.xUSdFhL29 entropy: 7.99959823492 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.xUSdFhL29 entropy: 7.99720777668 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\pl.pak.xUSdFhL29 entropy: 7.99956175672 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\ms.pak.xUSdFhL29 entropy: 7.99962741651 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\lt.pak.xUSdFhL29 entropy: 7.99931973927 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\lv.pak.xUSdFhL29 entropy: 7.99968348882 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\sw.pak.xUSdFhL29 entropy: 7.99962058457 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\sv.pak.xUSdFhL29 entropy: 7.99960699616 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\ro.pak.xUSdFhL29 entropy: 7.99962010097 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\sl.pak.xUSdFhL29 entropy: 7.9995943351 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\pt-PT.pak.xUSdFhL29 entropy: 7.99961650159 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\sk.pak.xUSdFhL29 entropy: 7.99961817252 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\pt-BR.pak.xUSdFhL29 entropy: 7.99963257563 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\nl.pak.xUSdFhL29 entropy: 7.9995485601 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\nb.pak.xUSdFhL29 entropy: 7.99955675255 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.xUSdFhL29 entropy: 7.99916347396 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.xUSdFhL29 entropy: 7.99904900875 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\zh-TW.pak.xUSdFhL29 entropy: 7.99953552055 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\zh-CN.pak.xUSdFhL29 entropy: 7.99955291221 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Chromium\Application\114.0.5735.90\Locales\tr.pak.xUSdFhL29 entropy: 7.99959147507 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.xUSdFhL29 entropy: 7.99203231579 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.xUSdFhL29 entropy: 7.99935276253 Jump to dropped file
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp.xUSdFhL29 entropy: 7.9989539006 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\dllhost.exe entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\AAAAAAAAAAA (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\BBBBBBBBBBB (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\CCCCCCCCCCC (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\DDDDDDDDDDD (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\EEEEEEEEEEE (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\FFFFFFFFFFF (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\GGGGGGGGGGG (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\HHHHHHHHHHH (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\IIIIIIIIIII (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\JJJJJJJJJJJ (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\KKKKKKKKKKK (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\LLLLLLLLLLL (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\MMMMMMMMMMM (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\NNNNNNNNNNN (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\OOOOOOOOOOO (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\PPPPPPPPPPP (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\QQQQQQQQQQQ (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\RRRRRRRRRRR (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\SSSSSSSSSSS (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\TTTTTTTTTTT (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\UUUUUUUUUUU (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\VVVVVVVVVVV (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\WWWWWWWWWWW (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\XXXXXXXXXXX (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\YYYYYYYYYYY (copy) entropy: 7.99687939679 Jump to dropped file
Source: C:\ProgramData\92D9.tmp File created: C:\Users\user\Desktop\ZZZZZZZZZZZ (copy) entropy: 7.99687939679 Jump to dropped file

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: dllhost.exe, type: SAMPLE Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Source: 1.0.dllhost.exe.ce0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Source: 00000001.00000000.1205884284.0000000000CE1000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Contains functionality to call native functions
Source: C:\ProgramData\92D9.tmp Code function: 12_2_00402760 CreateFileW,ReadFile,NtClose, 12_2_00402760
Source: C:\ProgramData\92D9.tmp Code function: 12_2_0040286C NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess, 12_2_0040286C
Source: C:\ProgramData\92D9.tmp Code function: 12_2_00402F18 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,SetFilePointerEx,NtFreeVirtualMemory,NtClose,DeleteFileW, 12_2_00402F18
Source: C:\ProgramData\92D9.tmp Code function: 12_2_00401DC2 NtProtectVirtualMemory, 12_2_00401DC2
Source: C:\ProgramData\92D9.tmp Code function: 12_2_00401D94 NtSetInformationThread, 12_2_00401D94
Source: C:\ProgramData\92D9.tmp Code function: 12_2_004016B4 NtAllocateVirtualMemory,NtAllocateVirtualMemory, 12_2_004016B4
Creates files inside the system directory
Source: C:\Windows\splwow64.exe File created: C:\Windows\system32\spool\PRINTERS\00002.SPL
Enables security privileges
Source: C:\Users\user\Desktop\dllhost.exe Process token adjusted: Security
Uses 32bit PE files
Source: dllhost.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: dllhost.exe, type: SAMPLE Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: 1.0.dllhost.exe.ce0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: 00000001.00000000.1205884284.0000000000CE1000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: classification engine Classification label: mal100.rans.phis.spyw.evad.winEXE@11/1690@0/0
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\xUSdFhL29.README.txt Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6240:120:WilError_03
Source: C:\ProgramData\92D9.tmp Mutant created: \Sessions\1\BaseNamedObjects\Global\{649F4E29-16CB-DD42-8922-9FFF0592856B}
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Mutant created: \Sessions\1\BaseNamedObjects\OneNoteM:AppShared
Source: C:\Users\user\Desktop\dllhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\8a06c4b60014a6fe5db845dd2c3f75c6
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\dllhost.exe "C:\Users\user\Desktop\dllhost.exe"
Source: C:\Users\user\Desktop\dllhost.exe Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\Desktop\dllhost.exe Process created: C:\ProgramData\92D9.tmp "C:\ProgramData\92D9.tmp"
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{D8D07292-B10A-4D24-9495-A9C057D3ECEE}.xps" 133580332770710000
Source: C:\ProgramData\92D9.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\92D9.tmp >> NUL
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE /tsr
Source: C:\Users\user\Desktop\dllhost.exe Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Process created: C:\ProgramData\92D9.tmp "C:\ProgramData\92D9.tmp" Jump to behavior
Source: C:\ProgramData\92D9.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\92D9.tmp >> NUL
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE /tsr
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: gpedit.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: dssec.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: dsuiext.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: authz.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: adsldp.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\ProgramData\92D9.tmp Section loaded: apphelp.dll
Source: C:\ProgramData\92D9.tmp Section loaded: rstrtmgr.dll
Source: C:\ProgramData\92D9.tmp Section loaded: ncrypt.dll
Source: C:\ProgramData\92D9.tmp Section loaded: ntasn1.dll
Source: C:\ProgramData\92D9.tmp Section loaded: windows.storage.dll
Source: C:\ProgramData\92D9.tmp Section loaded: wldp.dll
Source: C:\ProgramData\92D9.tmp Section loaded: kernel.appcore.dll
Source: C:\ProgramData\92D9.tmp Section loaded: uxtheme.dll
Source: C:\ProgramData\92D9.tmp Section loaded: propsys.dll
Source: C:\ProgramData\92D9.tmp Section loaded: profapi.dll
Source: C:\ProgramData\92D9.tmp Section loaded: edputil.dll
Source: C:\ProgramData\92D9.tmp Section loaded: urlmon.dll
Source: C:\ProgramData\92D9.tmp Section loaded: iertutil.dll
Source: C:\ProgramData\92D9.tmp Section loaded: srvcli.dll
Source: C:\ProgramData\92D9.tmp Section loaded: netutils.dll
Source: C:\ProgramData\92D9.tmp Section loaded: windows.staterepositoryps.dll
Source: C:\ProgramData\92D9.tmp Section loaded: sspicli.dll
Source: C:\ProgramData\92D9.tmp Section loaded: wintypes.dll
Source: C:\ProgramData\92D9.tmp Section loaded: appresolver.dll
Source: C:\ProgramData\92D9.tmp Section loaded: bcp47langs.dll
Source: C:\ProgramData\92D9.tmp Section loaded: slc.dll
Source: C:\ProgramData\92D9.tmp Section loaded: userenv.dll
Source: C:\ProgramData\92D9.tmp Section loaded: sppc.dll
Source: C:\ProgramData\92D9.tmp Section loaded: onecorecommonproxystub.dll
Source: C:\ProgramData\92D9.tmp Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: c2r32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: msi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: srpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: wldp.dll
Source: C:\Users\user\Desktop\dllhost.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\InprocServer32 Jump to behavior
Source: Send to OneNote.lnk.13.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: dllhost.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: dllhost.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\xUSdFhL29.README.txt ' source: dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.xUSdFhL29xt source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1251339725.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\xUSdFhL29.README.txtp?~ source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1251339725.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1257074503.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.xUSdFhL29 source: dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.xUSdFhL29n' source: dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1263356381.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1256528513.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1260962935.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\USdFhL29.README.txt source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\F" source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1263356381.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1256528513.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1260962935.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\xUSdFhL29.README.txt source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1260962935.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1256528513.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
PE file contains an invalid checksum
Source: dllhost.exe Static PE information: real checksum: 0x28150 should be: 0x26436
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Videos\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Searches\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Saved Games\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Recent\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Pictures\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Pictures\Saved Pictures\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Pictures\Camera Roll\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\OneDrive\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Music\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Links\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Favorites\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Favorites\Links\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Downloads\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\ZGGKNSUKOP\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\VWDFPKGDUF\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\UNKRLCVOHV\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\TQDFJHPUIU\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\SNIPGPPREP\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\Outlook Files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\KLIZUSIQEN\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\EOWRVPQCCS\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\DUUDTUBZFW\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Documents\CZQKSDDMWR\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\ZGGKNSUKOP\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\VWDFPKGDUF\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\UNKRLCVOHV\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\TQDFJHPUIU\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\SNIPGPPREP\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\KLIZUSIQEN\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\EOWRVPQCCS\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\DUUDTUBZFW\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Desktop\CZQKSDDMWR\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\Contacts\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\to-be-removed\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\temporary\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionstore-backups\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\security_state\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\minidumps\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\tmp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\events\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\db\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\crashes\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\crashes\events\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\bookmarkbackups\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\m8f4v4pw.default\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Headlights\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\a8578cfd-76c6-4d8c-b5cf-76b4c5e3ac6b\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\VirtualStore\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\{12D753DB-DED8-4673-9841-1F22083226EE}\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\VBE\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_3412_1715673340\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_3188_434848908\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Low\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_968483001\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_944194922\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_863982884\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_794381239\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_530746050\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_471632188\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_465642094\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_357048388\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_243013742\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_2099027583\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_2069604627\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_2017517930\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1623700211\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1451159892\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1423642920\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1244100889\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1202679133\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1151647528\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrocef_low\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\SolidDocuments\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Publishers\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\PeerDistRepub\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ca8e2f5b-10d2-46de-ab48-fe4a97755e77}\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\xUSdFhL29.README.txt Jump to behavior
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk
Stores files to the Windows start menu directory
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk

Hooking and other Techniques for Hiding and Protection
barindex
Deletes itself after installation
Source: C:\ProgramData\92D9.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\92D9.tmp >> NUL
Source: C:\ProgramData\92D9.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\92D9.tmp >> NUL
Source: C:\Users\user\Desktop\dllhost.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\ProgramData\92D9.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Source: C:\ProgramData\92D9.tmp Code function: 12_2_00401E28 12_2_00401E28
Found evasive API chain (may stop execution after checking mutex)
Source: C:\ProgramData\92D9.tmp Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Contains functionality for execution timing, often used to detect debuggers
Source: C:\ProgramData\92D9.tmp Code function: 12_2_00401E28 rdtsc 12_2_00401E28
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\dllhost.exe TID: 6444 Thread sleep count: 47 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\ProgramData\92D9.tmp Code function: 12_2_0040227C FindFirstFileExW, 12_2_0040227C
Source: C:\ProgramData\92D9.tmp Code function: 12_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose, 12_2_0040152C
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\ Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\ Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\ Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\ Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\ Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe Process information queried: ProcessInformation

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\ProgramData\92D9.tmp Thread information set: HideFromDebugger
Contains functionality for execution timing, often used to detect debuggers
Source: C:\ProgramData\92D9.tmp Code function: 12_2_00401E28 rdtsc 12_2_00401E28
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\ProgramData\92D9.tmp Code function: 12_2_00401474 LdrLoadDll, 12_2_00401474
Enables debug privileges
Source: C:\Users\user\Desktop\dllhost.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\dllhost.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\dllhost.exe Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\dllhost.exe Memory written: C:\ProgramData\92D9.tmp base: 401000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\dllhost.exe Process created: C:\ProgramData\92D9.tmp "C:\ProgramData\92D9.tmp" Jump to behavior
Source: C:\ProgramData\92D9.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\92D9.tmp >> NUL
Contains functionality to query CPU information (cpuid)
Source: C:\ProgramData\92D9.tmp Code function: 12_2_00401E28 cpuid 12_2_00401E28

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Overwrites Mozilla Firefox settings
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\to-be-removed\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\temporary\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionstore-backups\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\security_state\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\minidumps\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\tmp\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\events\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\db\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\crashes\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\crashes\events\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\bookmarkbackups\xUSdFhL29.README.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\m8f4v4pw.default\xUSdFhL29.README.txt Jump to behavior

Stealing of Sensitive Information
barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\59f06e22-78e3-4143-9d34-bd19d6977013.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583313145.c52da37e-6215-4698-a8c6-7dbc7928eb26.main.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\c3c38e93-087d-4203-9b06-06d6d3074fb6.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\fb7b70db-f644-4d7e-96ca-497c509ef330.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\639d6aff-3521-475f-a165-426024f2d9f0 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\content-prefs.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\events\background-update Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionCheckpoints.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\m8f4v4pw.default\times.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\1864eebe-a97d-4196-ba9e-40ba8339789c.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\44fdd5c8-5b97-4814-aaa2-3feb97513132.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\shield-preference-experiments.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\places.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583313139.639d6aff-3521-475f-a165-426024f2d9f0.health.jsonlz4.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\1864eebe-a97d-4196-ba9e-40ba8339789c Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionstore-backups\previous.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\b410c22f-bd2f-4284-b486-a9eaccce4c0d Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\containers.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\search.json.mozlz4.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\aabf5a2e-4b35-4c83-b535-ad48f381cc40.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583304864.8c7e12a2-deef-4b63-9655-b8092c733a4d.event.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\times.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583313138.717ed3b2-ea8b-46bf-926c-0346b661d09a.event.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\shield-preference-experiments.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\SiteSecurityServiceState.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\cc17ce6f-06b5-463f-bb50-565238b1adcf.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583313113.1864eebe-a97d-4196-ba9e-40ba8339789c.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\ls-archive.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\compatibility.ini.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\webappsstore.sqlite-shm.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\targeting.snapshot.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs.js.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\times.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\favicons.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionstore-backups\previous.jsonlz4.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\search.json.mozlz4 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\ExperimentStoreData.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\8c7e12a2-deef-4b63-9655-b8092c733a4d.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\state.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\4543e2b6-0dac-4484-972e-233c4ffdcfcd.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\c52da37e-6215-4698-a8c6-7dbc7928eb26.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\3bf2aef3-40fb-4049-b0b1-de69ef442f80.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\59f06e22-78e3-4143-9d34-bd19d6977013 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\webappsstore.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\717ed3b2-ea8b-46bf-926c-0346b661d09a.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\d6417413-e26c-46c2-ab09-55872479ca45 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\webappsstore.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\b0fc05c3-ead2-408e-9808-728375d77a75.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\session-state.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\e04bd3a6-7ee1-4fbc-ab75-afaa6d22d841 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\permissions.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\places.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionstore.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\state.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\fb7b70db-f644-4d7e-96ca-497c509ef330 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583313138.717ed3b2-ea8b-46bf-926c-0346b661d09a.event.jsonlz4.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\extension-preferences.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\AlternateServices.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\protections.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\e04bd3a6-7ee1-4fbc-ab75-afaa6d22d841.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\favicons.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\717ed3b2-ea8b-46bf-926c-0346b661d09a Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583304868.59f06e22-78e3-4143-9d34-bd19d6977013.main.jsonlz4.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\8351b15a-8c18-4057-9b61-d8f7b30b6b9a Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\SiteSecurityServiceState.txt.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\xulstore.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\aabf5a2e-4b35-4c83-b535-ad48f381cc40 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\webappsstore.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583304869.4543e2b6-0dac-4484-972e-233c4ffdcfcd.first-shutdown.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\favicons.sqlite-shm.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583304869.4543e2b6-0dac-4484-972e-233c4ffdcfcd.first-shutdown.jsonlz4.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\addons.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\b410c22f-bd2f-4284-b486-a9eaccce4c0d.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\c3c38e93-087d-4203-9b06-06d6d3074fb6 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\.metadata-v2 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\containers.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cookies.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\8c7e12a2-deef-4b63-9655-b8092c733a4d Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\content-prefs.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\ls-archive.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\3bf2aef3-40fb-4049-b0b1-de69ef442f80 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\8351b15a-8c18-4057-9b61-d8f7b30b6b9a.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\adb8b18e-cd15-4384-96ad-7a24cb8036ae.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\b4543248-1d51-4481-ad31-df186015c172.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\639d6aff-3521-475f-a165-426024f2d9f0.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583313139.639d6aff-3521-475f-a165-426024f2d9f0.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\compatibility.ini Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\d6417413-e26c-46c2-ab09-55872479ca45.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\adb8b18e-cd15-4384-96ad-7a24cb8036ae Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\places.sqlite-shm.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\events\events Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583313113.1864eebe-a97d-4196-ba9e-40ba8339789c.health.jsonlz4.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\m8f4v4pw.default\times.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cookies.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\b0fc05c3-ead2-408e-9808-728375d77a75 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\374bde87-f199-4fac-a615-01ab90ab0bf7 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\targeting.snapshot.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\addonStartup.json.lz4 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\addonStartup.json.lz4.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\44fdd5c8-5b97-4814-aaa2-3feb97513132 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\addons.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\extension-preferences.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\favicons.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\pkcs11.txt Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\cb86a51f-0e87-4a29-bb85-0245769bc428 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583304861.b0fc05c3-ead2-408e-9808-728375d77a75.new-profile.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583304868.59f06e22-78e3-4143-9d34-bd19d6977013.main.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\4543e2b6-0dac-4484-972e-233c4ffdcfcd Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583304861.b0fc05c3-ead2-408e-9808-728375d77a75.new-profile.jsonlz4.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\fa0c2f7b-2db4-4e24-b345-4ff05ffa9493.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\xulstore.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\events\background-update.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\ExperimentStoreData.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\AlternateServices.txt.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\374bde87-f199-4fac-a615-01ab90ab0bf7.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\handlers.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cookies.sqlite-shm.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\events\events.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\permissions.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\fa0c2f7b-2db4-4e24-b345-4ff05ffa9493 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\handlers.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\c52da37e-6215-4698-a8c6-7dbc7928eb26 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\b4543248-1d51-4481-ad31-df186015c172 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583313145.c52da37e-6215-4698-a8c6-7dbc7928eb26.main.jsonlz4.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\1696583304864.8c7e12a2-deef-4b63-9655-b8092c733a4d.event.jsonlz4.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionCheckpoints.json.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\session-state.json Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\cb86a51f-0e87-4a29-bb85-0245769bc428.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\protections.sqlite Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\cc17ce6f-06b5-463f-bb50-565238b1adcf Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\pkcs11.txt.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionstore.jsonlz4.xUSdFhL29 Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\.metadata-v2.xUSdFhL29 Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1428961 Sample: dllhost.exe Startdate: 19/04/2024 Architecture: WINDOWS Score: 100 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 Found ransom note / readme 2->46 48 4 other signatures 2->48 8 dllhost.exe 36 1002 2->8         started        12 ONENOTE.EXE 2->12         started        process3 file4 26 {1AC14E77-02E7-4E5...}_cmd_exe.xUSdFhL29, DOS 8->26 dropped 28 C:\Users\user\AppData\...\hr.pak.xUSdFhL29, DOS 8->28 dropped 30 ~Outlook Data File...l.pst.tmp.xUSdFhL29, data 8->30 dropped 32 212 other files (204 malicious) 8->32 dropped 50 Found potential ransomware demand text 8->50 52 Found Tor onion address 8->52 54 Overwrites Mozilla Firefox settings 8->54 56 5 other signatures 8->56 14 92D9.tmp 8->14         started        18 splwow64.exe 8->18         started        20 ONENOTEM.EXE 12->20         started        signatures5 process6 file7 34 C:\Users\user\Desktop\dllhost.exe, data 14->34 dropped 36 C:\Users\user\Desktop\ZZZZZZZZZZZ (copy), data 14->36 dropped 38 C:\Users\user\Desktop\YYYYYYYYYYY (copy), data 14->38 dropped 40 24 other malicious files 14->40 dropped 58 Found evasive API chain (may stop execution after checking mutex) 14->58 60 Contains functionality to detect hardware virtualization (CPUID execution measurement) 14->60 62 Writes many files with high entropy 14->62 64 2 other signatures 14->64 22 cmd.exe 14->22         started        signatures8 process9 process10 24 conhost.exe 22->24         started       
⊘No contacted IP infos