Edit tour

Windows Analysis Report
dllhost.exe

Overview

General Information

Sample name:	dllhost.exe
Analysis ID:	1428961
MD5:	2fc802ab965a8ea49c5611eac53b925a
SHA1:	04dbddc0bf777077f1834085c79cb38d556eb2f2
SHA256:	57cb9051d4709e33fb38ec9e9170878e1f952f3180b75b00e030c378d55235ce
Infos:

Detection

LockBit ransomware

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Yara detected LockBit ransomware

Changes the wallpaper picture

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Deletes itself after installation

Found Tor onion address

Found evasive API chain (may stop execution after checking mutex)

Found potential ransomware demand text

Hides threads from debuggers

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Overwrites Mozilla Firefox settings

Sigma detected: System File Execution Location Anomaly

Tries to harvest and steal browser information (history, passwords, etc)

Writes many files with high entropy

Writes to foreign memory regions

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Enables debug privileges

Enables security privileges

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potentially Suspicious Desktop Background Change Via Registry

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64_ra

dllhost.exe (PID: 6536 cmdline: "C:\Users\user\Desktop\dllhost.exe" MD5: 2FC802AB965A8EA49C5611EAC53B925A)

splwow64.exe (PID: 2412 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

92D9.tmp (PID: 5748 cmdline: "C:\ProgramData\92D9.tmp" MD5: 294E9F64CB1642DD89229FFF0592856B)

cmd.exe (PID: 6404 cmdline: "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\92D9.tmp >> NUL MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ONENOTE.EXE (PID: 5672 cmdline: /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{D8D07292-B10A-4D24-9495-A9C057D3ECEE}.xps" 133580332770710000 MD5: 0061760D72416BCF5F2D9FA6564F0BEA)

ONENOTEM.EXE (PID: 1768 cmdline: /tsr MD5: 384774DF70AD266F59512936C77602A6)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
dllhost.exe	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
dllhost.exe	Windows_Ransomware_Lockbit_369e1e94	unknown	unknown	0x1861d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00 0x4d4:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000000.1205884284.0000000000CE1000.00000020.00000001.01000000.00000006.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000001.00000000.1205884284.0000000000CE1000.00000020.00000001.01000000.00000006.sdmp	Windows_Ransomware_Lockbit_369e1e94	unknown	unknown	0x1841d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00 0xd4:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...
00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
Process Memory Space: dllhost.exe PID: 6536	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.dllhost.exe.ce0000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
1.0.dllhost.exe.ce0000.0.unpack	Windows_Ransomware_Lockbit_369e1e94	unknown	unknown	0x1861d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00 0x4d4:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...

Sigma Signatures

System Summary

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\Desktop\dllhost.exe", CommandLine: "C:\Users\user\Desktop\dllhost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\dllhost.exe, NewProcessName: C:\Users\user\Desktop\dllhost.exe, OriginalFileName: C:\Users\user\Desktop\dllhost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: "C:\Users\user\Desktop\dllhost.exe", ProcessId: 6536, ProcessName: dllhost.exe

Sigma detected: Potentially Suspicious Desktop Background Change Via Registry

Source: Registry Key set

Author: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ): Data: Details: C:\ProgramData\xUSdFhL29.bmp, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\dllhost.exe, ProcessId: 6536, TargetObject: HKEY_CURRENT_USER\Control Panel\Desktop\WallPaper

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, ProcessId: 5672, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: dllhost.exe

Avira: detected

Machine Learning detection for sample

Source: dllhost.exe

Joe Sandbox ML: detected

Source: dllhost.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Videos\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Searches\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Saved Games\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Recent\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Pictures\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Pictures\Saved Pictures\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Pictures\Camera Roll\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\OneDrive\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Music\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Links\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Favorites\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Favorites\Links\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Downloads\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Documents\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Documents\ZGGKNSUKOP\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Documents\VWDFPKGDUF\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Documents\UNKRLCVOHV\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Documents\TQDFJHPUIU\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Documents\SNIPGPPREP\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Documents\Outlook Files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Documents\KLIZUSIQEN\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Documents\EOWRVPQCCS\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Documents\DUUDTUBZFW\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Documents\CZQKSDDMWR\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Desktop\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Desktop\ZGGKNSUKOP\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Desktop\VWDFPKGDUF\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Desktop\UNKRLCVOHV\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Desktop\TQDFJHPUIU\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Desktop\SNIPGPPREP\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Desktop\KLIZUSIQEN\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Desktop\EOWRVPQCCS\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Desktop\DUUDTUBZFW\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Desktop\CZQKSDDMWR\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\Contacts\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\to-be-removed\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\temporary\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionstore-backups\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\security_state\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\minidumps\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\tmp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\events\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\db\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\crashes\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\crashes\events\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\bookmarkbackups\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\m8f4v4pw.default\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Headlights\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\a8578cfd-76c6-4d8c-b5cf-76b4c5e3ac6b\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\VirtualStore\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\{12D753DB-DED8-4673-9841-1F22083226EE}\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\VBE\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Symbols\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_3412_1715673340\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_3188_434848908\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Low\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_968483001\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_944194922\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_863982884\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_794381239\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_530746050\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_471632188\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_465642094\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_357048388\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_243013742\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_2099027583\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_2069604627\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_2017517930\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1623700211\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1451159892\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1423642920\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1244100889\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1202679133\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\edge_BITS_1068_1151647528\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\acrocef_low\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\SolidDocuments\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Publishers\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\PeerDistRepub\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ca8e2f5b-10d2-46de-ab48-fe4a97755e77}\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\xUSdFhL29.README.txt	Jump to behavior

Source: dllhost.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\xUSdFhL29.README.txt ' source: dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.xUSdFhL29xt source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1251339725.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\xUSdFhL29.README.txtp?~ source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1251339725.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1257074503.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.xUSdFhL29 source: dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.xUSdFhL29n' source: dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1263356381.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1256528513.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1260962935.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\USdFhL29.README.txt source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\F" source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1263356381.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1256528513.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1250557413.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1260962935.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\xUSdFhL29.README.txt source: dllhost.exe, 00000001.00000003.1255409616.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248684868.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1248207443.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1249177884.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1260962935.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1253240085.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1256528513.00000000012F4000.00000004.00000020.00020000.00000000.sdmp

Source: C:\ProgramData\92D9.tmp	Code function: 12_2_0040227C FindFirstFileExW,		12_2_0040227C
Source: C:\ProgramData\92D9.tmp	Code function: 12_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose,		12_2_0040152C

Source: C:\Users\user\Desktop\dllhost.exe	File opened: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File opened: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File opened: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File opened: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File opened: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File opened: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\	Jump to behavior

Networking

Found Tor onion address

Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionina
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onione&
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onional
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionl
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion^
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionalM
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionx
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion]
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion]
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion1
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionl,
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onioned
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionHC
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy
Source: dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
Source: dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
Source: dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion

Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitapt.uz
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion22-4DB4-AC8E-4E1DDDE828FE_cw5n1
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionina
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onional
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onione&
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionl
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion1
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionHC
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionalM
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onioned
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionl
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionx
Source: dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsupp.uz
Source: icudtl.dat.xUSdFhL29.1.dr	String found in binary or memory: http://www.unicode.org/copyright.html
Source: bn.pak.xUSdFhL29.1.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=bn&category=theme81https://myactivity.google.com/myactivity/?u
Source: hi.pak.xUSdFhL29.1.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=hi&category=theme81https://myactivity.google.com/myactivity/?u
Source: ru.pak.xUSdFhL29.1.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ru&category=theme81https://myactivity.google.com/myactivity/?u
Source: dllhost.exe, 00000001.00000003.1410010413.000000000138C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=th
Source: th.pak.xUSdFhL29.1.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=th&category=theme81https://myactivity.google.com/myactivity/?u
Source: dllhost.exe, 00000001.00000003.1410010413.000000000138C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=trK
Source: dllhost.exe, 00000001.00000003.1410010413.000000000138C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=uk
Source: uk.pak.xUSdFhL29.1.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u
Source: dllhost.exe, 00000001.00000003.1416285727.00000000046E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	String found in binary or memory: https://myactivity.google.com/
Source: dllhost.exe, 00000001.00000003.1416285727.00000000046E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, th.pak.xUSdFhL29.1.dr	String found in binary or memory: https://passwords.google.com
Source: hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	String found in binary or memory: https://passwords.google.comGoogle
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	String found in binary or memory: https://policies.google.com/
Source: dllhost.exe, 00000001.00000003.1408706397.000000000125B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1416285727.00000000046E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, uk.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr, ru.pak.xUSdFhL29.1.dr, fa.pak.xUSdFhL29.1.dr, th.pak.xUSdFhL29.1.dr	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: dllhost.exe, 00000001.00000003.1408706397.000000000125B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1416285727.00000000046E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, uk.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr, ru.pak.xUSdFhL29.1.dr, fa.pak.xUSdFhL29.1.dr, th.pak.xUSdFhL29.1.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: dllhost.exe, 00000001.00000003.1410010413.000000000138C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: dllhost.exe, 00000001.00000003.1222047576.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1222047576.00000000012DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.oGUCFCdKfd-E
Source: dllhost.exe, 00000001.00000003.1623107102.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tox.ch
Source: dllhost.exe, 00000001.00000003.1623107102.0000000001235000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1211501555.0000000001238000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1220039729.000000000121F000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1211501555.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1623107102.000000000123A000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1623107102.0000000001238000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1220039729.000000000122E000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1625597855.0000000001236000.00000004.00000020.00020000.00000000.sdmp, xUSdFhL29.README.txt303.1.dr, xUSdFhL29.README.txt384.1.dr, xUSdFhL29.README.txt193.1.dr, xUSdFhL29.README.txt355.1.dr, xUSdFhL29.README.txt473.1.dr, xUSdFhL29.README.txt226.1.dr, xUSdFhL29.README.txt148.1.dr, xUSdFhL29.README.txt119.1.dr, xUSdFhL29.README.txt43.1.dr, xUSdFhL29.README.txt448.1.dr, xUSdFhL29.README.txt404.1.dr, xUSdFhL29.README.txt198.1.dr	String found in binary or memory: https://tox.chat
Source: dllhost.exe, 00000001.00000003.1222047576.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1222047576.00000000012DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.c0yfKF26qNRb
Source: dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.w0HgyL2ZPBj2
Source: dllhost.exe, 00000001.00000003.1222047576.00000000012E4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: dllhost.exe, 00000001.00000003.1222047576.00000000012E4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalCache\xUSdFhL29.README.txt

Dropped file: >>>> Your data are stolen and encrypted!>>>> Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Your competitors or law enforcement may get them on the web.Data includes:- Employees personal data, CVs, DL, SSN.- Complete network map including credentials for local and remote services.- Financial information including clients data, bills, budgets, annual reports, bank statements.- Complete datagrams/schemas/drawings for manufacturing in solidworks format- And more...You can request the tree of files that we have.>>>> You need contact us and decrypt one file for free, send a small file for test decryption with your personal DECRYPTION ID to tox chat:>>>> Your personal DECRYPTION ID: A96FA3AD1739CBD80C7E9E83972951361)Download and install TOX chat: https://tox.chat2)Write to this tox id: DED25DCB2AAAF65A05BEA584A0D1BB1D55DD2D8BB4185FA39B5175C60C8DDD0C0A7F8A8EC815 and wait for the answer, we will always answer you.>>>> DO NOT MODIFY FILES YOURSELF.>>>> DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA.>>>> YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS.>>>> YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY.

Source: Yara match	File source: dllhost.exe, type: SAMPLE
Source: Yara match	File source: 1.0.dllhost.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1205884284.0000000000CE1000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dllhost.exe PID: 6536, type: MEMORYSTR

Source: dllhost.exe, 00000001.00000003.1623107102.0000000001235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory : All your important files are stolen and encrypted!
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory : Your data are stolen and encryptedr
Source: dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory : Your data are stolen and encrypted
Source: dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory : Your data are stolen and encrypted
Source: dllhost.exe, 00000001.00000003.1211501555.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: dllhost.exe, 00000001.00000003.1623107102.000000000123A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: dllhost.exe, 00000001.00000003.1623107102.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: dllhost.exe, 00000001.00000003.1220039729.000000000122E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: dllhost.exe, 00000001.00000002.1625597855.0000000001236000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt303.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt384.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt193.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt355.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt473.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt226.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt148.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt119.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt43.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt448.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt404.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt198.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt360.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt299.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt496.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt372.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt262.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt485.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt96.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt67.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt510.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt281.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt333.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt69.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt77.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt407.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt110.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt13.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt65.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt192.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt445.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt513.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt215.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt204.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt223.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt33.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt311.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt86.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt181.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt206.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt64.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt352.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt481.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt49.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt100.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt216.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt420.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt191.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt106.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt285.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt98.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt450.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt80.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt424.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt354.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt336.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt302.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt85.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt183.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt59.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt331.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt512.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt243.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt194.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt229.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt24.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt489.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt146.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt488.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt435.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt459.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt416.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt178.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt116.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt22.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt335.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt166.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt497.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt197.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt141.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt257.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt169.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt99.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt162.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt415.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt217.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt188.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt444.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt345.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt290.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt288.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt47.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt205.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt102.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt7.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt409.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt482.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt145.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt202.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt490.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt196.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt219.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt21.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt143.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt508.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt329.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt16.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt74.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt495.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt39.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt378.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt41.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt343.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt124.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt339.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt417.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt477.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt436.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt171.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt362.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt258.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt318.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt309.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt521.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt38.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt325.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt153.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt1.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt425.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!
Source: xUSdFhL29.README.txt462.1.dr	String found in binary or memory : >>>> Your data are stolen and encrypted!

Source: C:\Users\user\Desktop\dllhost.exe	File moved: C:\Users\user\Desktop\EOWRVPQCCS\EOWRVPQCCS.docx	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File moved: C:\Users\user\Desktop\EOWRVPQCCS\QCOILOQIKC.png	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File moved: C:\Users\user\Desktop\DUUDTUBZFW\ZGGKNSUKOP.pdf	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File moved: C:\Users\user\Desktop\EOWRVPQCCS.docx	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File moved: C:\Users\user\Desktop\ZGGKNSUKOP\GIGIYTFFYT.xlsx	Jump to behavior

Source: dllhost.exe, type: SAMPLE	Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Source: 1.0.dllhost.exe.ce0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Source: 00000001.00000000.1205884284.0000000000CE1000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown

Source: C:\ProgramData\92D9.tmp	Code function: 12_2_00402760 CreateFileW,ReadFile,NtClose,	12_2_00402760
Source: C:\ProgramData\92D9.tmp	Code function: 12_2_0040286C NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	12_2_0040286C
Source: C:\ProgramData\92D9.tmp	Code function: 12_2_00402F18 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,SetFilePointerEx,NtFreeVirtualMemory,NtClose,DeleteFileW,	12_2_00402F18
Source: C:\ProgramData\92D9.tmp	Code function: 12_2_00401DC2 NtProtectVirtualMemory,	12_2_00401DC2
Source: C:\ProgramData\92D9.tmp	Code function: 12_2_00401D94 NtSetInformationThread,	12_2_00401D94
Source: C:\ProgramData\92D9.tmp	Code function: 12_2_004016B4 NtAllocateVirtualMemory,NtAllocateVirtualMemory,	12_2_004016B4

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6240:120:WilError_03
Source: C:\ProgramData\92D9.tmp	Mutant created: \Sessions\1\BaseNamedObjects\Global\{649F4E29-16CB-DD42-8922-9FFF0592856B}
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Mutant created: \Sessions\1\BaseNamedObjects\OneNoteM:AppShared
Source: C:\Users\user\Desktop\dllhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\8a06c4b60014a6fe5db845dd2c3f75c6

Source: unknown	Process created: C:\Users\user\Desktop\dllhost.exe "C:\Users\user\Desktop\dllhost.exe"
Source: C:\Users\user\Desktop\dllhost.exe	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\Desktop\dllhost.exe	Process created: C:\ProgramData\92D9.tmp "C:\ProgramData\92D9.tmp"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{D8D07292-B10A-4D24-9495-A9C057D3ECEE}.xps" 133580332770710000
Source: C:\ProgramData\92D9.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\92D9.tmp >> NUL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE /tsr
Source: C:\Users\user\Desktop\dllhost.exe	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process created: C:\ProgramData\92D9.tmp "C:\ProgramData\92D9.tmp"	Jump to behavior
Source: C:\ProgramData\92D9.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\92D9.tmp >> NUL
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE /tsr

Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: gpedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: dssec.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: dsuiext.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: adsldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\92D9.tmp	Section loaded: apphelp.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: ncrypt.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: ntasn1.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: windows.storage.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: wldp.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: uxtheme.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: propsys.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: profapi.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: edputil.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: urlmon.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: iertutil.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: srvcli.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: netutils.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: sspicli.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: wintypes.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: appresolver.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: bcp47langs.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: slc.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: userenv.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: sppc.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\ProgramData\92D9.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: c2r32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: msi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: srpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\dllhost.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\92D9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\92D9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\dllhost.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\dllhost.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\dllhost.exe	Process token adjusted: Debug

Source: dllhost.exe, type: SAMPLE	Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: 1.0.dllhost.exe.ce0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: 00000001.00000000.1205884284.0000000000CE1000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18

Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\to-be-removed\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\temporary\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionstore-backups\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\security_state\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\saved-telemetry-pings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\minidumps\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\tmp\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\pending_pings\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\events\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\glean\db\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\datareporting\archived\2023-10\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\crashes\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\crashes\events\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\bookmarkbackups\xUSdFhL29.README.txt	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\m8f4v4pw.default\xUSdFhL29.README.txt	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	2 Registry Run Keys / Startup Folder	111 Process Injection	11 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Browser Session Hijacking	1 Proxy	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	111 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Data from Local System	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	111 Process Injection	Security Account Manager	111 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	112 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
dllhost.exe	100%	Avira	BDS/ZeroAccess.Gen7
dllhost.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://chromeenterprise.google/policies/#BrowserSwitcherEnabled	0%	URL Reputation	safe
https://passwords.google.comGoogle	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionl	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionHC	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://chromeenterprise.google/policies/#BrowserSwitcherEnabled	dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	false	URL Reputation: safe	unknown
https://tox.ch	dllhost.exe, 00000001.00000003.1623107102.0000000001238000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.google.com/chromebook?p=app_intent	dllhost.exe, 00000001.00000003.1410010413.000000000138C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onione&	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		low
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.google.com/chrome/answer/6098869	dllhost.exe, 00000001.00000003.1408706397.000000000125B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1416285727.00000000046E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, uk.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr, ru.pak.xUSdFhL29.1.dr, fa.pak.xUSdFhL29.1.dr, th.pak.xUSdFhL29.1.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.oGUCFCdKfd-E	dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.unicode.org/copyright.html	icudtl.dat.xUSdFhL29.1.dr	false		high
https://chrome.google.com/webstore?hl=ru&category=theme81https://myactivity.google.com/myactivity/?u	ru.pak.xUSdFhL29.1.dr	false		high
https://chrome.google.com/webstore?hl=th	dllhost.exe, 00000001.00000003.1410010413.000000000138C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onional	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion1	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://passwords.google.comGoogle	hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	false	URL Reputation: safe	unknown
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionina	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionl	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://chrome.google.com/webstore?hl=hi&category=theme81https://myactivity.google.com/myactivity/?u	hi.pak.xUSdFhL29.1.dr	false		high
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionx	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	dllhost.exe, 00000001.00000003.1222423443.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tox.chat	dllhost.exe, 00000001.00000003.1623107102.0000000001235000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1211501555.0000000001238000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1220039729.000000000121F000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1211501555.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1623107102.000000000123A000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1623107102.0000000001238000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1220039729.000000000122E000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1625597855.0000000001236000.00000004.00000020.00020000.00000000.sdmp, xUSdFhL29.README.txt303.1.dr, xUSdFhL29.README.txt384.1.dr, xUSdFhL29.README.txt193.1.dr, xUSdFhL29.README.txt355.1.dr, xUSdFhL29.README.txt473.1.dr, xUSdFhL29.README.txt226.1.dr, xUSdFhL29.README.txt148.1.dr, xUSdFhL29.README.txt119.1.dr, xUSdFhL29.README.txt43.1.dr, xUSdFhL29.README.txt448.1.dr, xUSdFhL29.README.txt404.1.dr, xUSdFhL29.README.txt198.1.dr	true		unknown
http://lockbitapt.uz	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://lockbitsupp.uz	dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://photos.google.com/settings?referrer=CHROME_NTP	dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	false	URL Reputation: safe	unknown
https://myactivity.google.com/	dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	false		high
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionalM	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	false	URL Reputation: safe	unknown
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onioned	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://chrome.google.com/webstore?hl=uk	dllhost.exe, 00000001.00000003.1410010413.000000000138C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist	dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	false	URL Reputation: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	false	URL Reputation: safe	unknown
https://passwords.google.com	dllhost.exe, 00000001.00000003.1416285727.00000000046E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, th.pak.xUSdFhL29.1.dr	false		high
https://policies.google.com/	dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	false		high
https://support.google.com/chrome/a/answer/9122284	dllhost.exe, 00000001.00000003.1408706397.000000000125B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1416285727.00000000046E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, uk.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr, ru.pak.xUSdFhL29.1.dr, fa.pak.xUSdFhL29.1.dr, th.pak.xUSdFhL29.1.dr	false		high
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion22-4DB4-AC8E-4E1DDDE828FE_cw5n1	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		low
https://chrome.google.com/webstore?hl=th&category=theme81https://myactivity.google.com/myactivity/?u	th.pak.xUSdFhL29.1.dr	false		high
https://support.mozilla.org	dllhost.exe, 00000001.00000003.1222047576.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1222047576.00000000012DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=bn&category=theme81https://myactivity.google.com/myactivity/?u	bn.pak.xUSdFhL29.1.dr	false		high
https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u	uk.pak.xUSdFhL29.1.dr	false		high
https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u	dllhost.exe, 00000001.00000003.1416285727.00000000046E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion	dllhost.exe, 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000002.1626365848.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://chrome.google.com/webstore?hl=trK	dllhost.exe, 00000001.00000003.1410010413.000000000138C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist	dllhost.exe, 00000001.00000003.1414451987.000000000138C000.00000004.00000020.00020000.00000000.sdmp, hi.pak.xUSdFhL29.1.dr, bn.pak.xUSdFhL29.1.dr	false	URL Reputation: safe	unknown

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428961
Start date and time:	2024-04-19 22:46:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dllhost.exe
Detection:	MAL
Classification:	mal100.rans.phis.spyw.evad.winEXE@11/1690@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 18 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Process:	C:\Users\user\Desktop\dllhost.exe
File Type:	data
Category:	dropped
Size (bytes):	129
Entropy (8bit):	6.507199735976317
Encrypted:	false
SSDEEP:	3:neQJ7Vdu78QWG5l1wnwK+re1MllwcXPv:nPJ7VMzWaFPrewicXPv
MD5:	F1B0DE3BF862EAE68A7585CBE6529424
SHA1:	5668A5B7493E572D5F96626F5F02A1B58CF27D03
SHA-256:	687B90DFE9FF8D078A8B1CF58847E15ECB1798812A816E31D9828CF6E733DE2B
SHA-512:	19977CCE40621368F6BEEF64C28A95E795C53FDD1554D3B9372D9368985B0DC2DD1B05E01596798E0A8812AC87E84C9802DE62A5EAA8798E9E4891E0706E98AB
Malicious:	false
Reputation:	low
Preview:	......r.A.......c.ED...O.#n......&!.l.....Ys.3.A3..U...:.........]1\....?......D...#.....;3..)8}l.....l..Q .o".v..J.

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166203
Entropy (8bit):	5.340922241791341
Encrypted:	false
SSDEEP:	1536:5+C7FPgOsB3U9guwwJQ9DQA+zqzhQik4F77nXmvYd8XRTEwreOR6g:gIQ9DQA+zqzMXeMJ
MD5:	846AA354025EBCEFFB4E41E818D69049
SHA1:	2AC9DD4CA58A2A7E87C28FA0043CF9071C6CDFC5
SHA-256:	D96DD6FE360B366BDB1F596AA8C8158AD4AEE4489D5C0606DA5A8D7BAC1D6131
SHA-512:	5563A3176EE5B93CC711A38D95CA0316B35C1A195ED48CC2BE9D1C616C2364BD7BE01AB9A1F98E603E9B33A11177765A812D023C826E91FDBC29A95708D0364B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-04-19T20:48:08">.. Build: 16.0.17609.40129-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuth

Process:	C:\ProgramData\92D9.tmp
File Type:	data
Category:	dropped
Size (bytes):	150016
Entropy (8bit):	7.996879396793158
Encrypted:	true
SSDEEP:
MD5:	E2AE40CFA723AB4FBAEB8CC2630AAF17
SHA1:	BAA36136BE30897DDD313A258DCA778C236C47F2
SHA-256:	7659C2292A00997A4B9BA771DEEE41F14EF97F708692612DF28B62FCDCD0E214
SHA-512:	1A948A12E6F09FFB1DE964E4BFD387AB42C2B3CB2C50F34680DD335EEE1A8320A46750DCEB295CFA2B17E78CC8A8B854E46A894CCC809E30FA9C3EED210C21E3
Malicious:	true
Preview:	..T.z7..\|...gB6%[...#...>df"5..,..RkI.Ba/r.......j...".I.6.....E0....d.V...E).......L.........W..6:../....0......O,xA77.Y.K5.o.\|......a....+^..eh.i.C...R...1L.........VZN.:...%.K... IM...r..........?:...Gv.Z..\.B@.h.2n"..l..7....+.'..i<..s@.....O.%SL.N...,GK...~....F...m.C.]...{..h.^.u.".U.....s....x.~w...+f..c...Q.Vt{$.......h...f....gw..b.leBl...O....].....g@....a..=.D..ZJ.)....},.K.(..4..e.G.....y..$..r.B.HVy.4..D..adX]...EE..7..\<.f.$&...Na.Fq@.Q..H........p..O8\...KU.i..k.@.r.{..X- ...MY..q ..tx!~.o.U...ov.?....VE`^..H....\...}.2!....t,e...A...W.D.m..(..W....D.,.....B..H7..M...\|Ck0......N.P.<4...w.`f..`...oH6.,.6.)...NY...)..Z...S..{..[I.Op....`E.,@.w...K....y5..9.i......9.)^.f._.lPsg$9.-....N...~.7. ..U..........<k..a.}R.-f.w..~.fW}.j.!\./...b21j).^.a.cO...H.8_s..4...^.../.<.....3}..);...~..w....y..W^.r.:..].....O......}.W.....Y.4.Z..2`...j....<.j.4.@ ..C..... .K...........x>.M....:.C.-:4.~R.Dj...D...w0OW.e;Ek..,U.B.

Process:	C:\Windows\splwow64.exe
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	13757392
Entropy (8bit):	7.8931650413428756
Encrypted:	false
SSDEEP:
MD5:	BC08DB9D830516BA047682A67D5C7CCE
SHA1:	15D99BBA49672FF32AEAAF85B6C0E95547D37F0F
SHA-256:	C0E10DDA63CB5F57D4480248E853F94578DA955FE634B7F75665621ADEAC952B
SHA-512:	CF9D0CA3A39C082B0EC362593691DF9363A9D60AB55F23172146186DE56A470D9678A7DF4FFAD7CCB9324CC15512E2C58CB3F7D1B323F3AAE6641E2BF7DA6545
Malicious:	false
Preview:	PK........}..X................[Content_Types].xml/[0].piece.....0..W..o.x .....e.(....Ql!..<...S^.MMw....#Nr.9....p..:..J.z..`3..DM....T.n..J..-c...3....&a#......PK....X.j...q...PK...........X................[Content_Types].xml/[1].piece..1..0....eE$....{e.C.&..X.........H\., .....o.T..i.."...K.s..4..VW...i+.Ak.....}....\.+..O?PK..K..jb...l...PK...........X................_rels/.rels/[0].pieceM.A..!.E.B.w...1.....9@...C!...?,].......f..4.qp.,.._^I...y?\`.....Cc.jF". .^...#g.T.A.e.c.........3.....PK...BpJl...y...PK...........X................_rels/.rels/[1].piece..K..0....9@&.....nk/.....O3S...s....L/'.UN...'.......P....UO:....=X......B..gD...c]...[..[..3..9.9a.... .....N.PK..4...u.......PK...........X................[Content_Types].xml/[2].piece-.A.. .F....p.u.q.&....!...m..[.n_^..kA.......>\|.......f....`........}..F..(v.6.t...0-.n.C\|@.N-.Z...PK....[Pm...{...PK...........X............%...FixedDocumentSequence.fdseq/[0].pieceU.M..0.F..fo&.....H.`..2.....H.o..p

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dllhost.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\AAAAAAAAAAA (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\BBBBBBBBBBB (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\CCCCCCCCCCC (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\DDDDDDDDDDD (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\EEEEEEEEEEE (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\FFFFFFFFFFF (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\GGGGGGGGGGG (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\HHHHHHHHHHH (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\IIIIIIIIIII (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\JJJJJJJJJJJ (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\KKKKKKKKKKK (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\LLLLLLLLLLL (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\MMMMMMMMMMM (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\NNNNNNNNNNN (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\OOOOOOOOOOO (copy)

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\PPPPPPPPPPP (copy)

Windows Analysis Report
dllhost.exe

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	4.186704345910024
Encrypted:	false
SSDEEP:
MD5:	0632B4464BAC02AC4E59913D1CFDB602
SHA1:	1DCD7DD836568E1D9DCD7A5D4B86457B7569BB0E
SHA-256:	B8CAB647AD2F6A64277BA66016D88A7F65497AD585E3A6B9B6E27EF030048ABA
SHA-512:	A9959177051378FCC8C53B8C523984014DA45406738FC15626F48C371B028320715A87491E0D6C1FA3EB68A58E314EE7DAAFF1B5C7DB039E83F295D51662A253
Malicious:	false
Preview:	C:\PROGRA~3\92D9.tmp..

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.207056490812997
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dllhost.exe
File size:	150'016 bytes
MD5:	2fc802ab965a8ea49c5611eac53b925a
SHA1:	04dbddc0bf777077f1834085c79cb38d556eb2f2
SHA256:	57cb9051d4709e33fb38ec9e9170878e1f952f3180b75b00e030c378d55235ce
SHA512:	d35fc5fbbff08c3235c0b7b69a1bd1af0334c8c1ac34d7a7b39c799dbbb831da42367579b3fc2ecf67eab84eff3475ff9c9f912d6c46e6329dee67a15f1b4f19
SSDEEP:	3072:zqJogYkcSNm9V7DZYnw8u5ldltVr7Yo3XZLT:zq2kc4m9tDppRPrlX
TLSH:	DCE36C21F25ED0B3C87718F21726B17DB3AA4D2C1AA57807E6D50F88BCA49232F4595F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....!c............................o.............@.................................P.....@...........@....................

Entrypoint:	0x41946f
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x632112B1 [Tue Sep 13 23:30:57 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	914685b69f2ac2ff61b6b0f1883a054d

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a230	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x27000	0xfcc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1a120	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1a000	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x17d46	0x17e00	57ad8095d0d1b2e0663fbd3ef4405410	False	0.48270819698952877	data	6.613530972543989	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x19000	0x569	0x600	0adcc204eb91a7bbe4f95e6c65202fe1	False	0.255859375	data	3.0389614741823974	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1a000	0x4b2	0x600	9264ea7f335858b063b39397d3c51d14	False	0.3821614583333333	data	3.6588662154359954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0xadc8	0xa000	679ded60252b47b7d17ee7218b1dac4b	False	0.9825927734375	SysEx File -	7.988165963776169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x26000	0xb2d	0xc00	6f56f5c5c7423d4a4dc174e52c1bd298	False	0.9485677083333334	data	7.723153017127608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x27000	0xfcc	0x1000	68a4352eca889669f544bd64baa3f961	False	0.8427734375	GLS_BINARY_LSB_FIRST	6.728533295109	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

DLL	Import
gdi32.dll	SetPixel, GetPixel, SelectPalette, SelectObject, GetTextColor, BitBlt, GetDeviceCaps, CreateSolidBrush, CreateFontW, CreateDIBitmap
USER32.dll	LoadMenuW, LoadImageW, CreateDialogParamW, CreateWindowExW, DefWindowProcW, GetDlgItem, IsDlgButtonChecked
KERNEL32.dll	GetLastError, GetProcAddress, GetModuleHandleA, GetLocaleInfoW, FreeLibrary, GetFileAttributesW, GetCommandLineW, GetCommandLineA

Target ID:	1
Start time:	22:47:24
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\dllhost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\dllhost.exe"
Imagebase:	0xce0000
File size:	150'016 bytes
MD5 hash:	2FC802AB965A8EA49C5611EAC53B925A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000001.00000000.1205884284.0000000000CE1000.00000020.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Ransomware_Lockbit_369e1e94, Description: unknown, Source: 00000001.00000000.1205884284.0000000000CE1000.00000020.00000001.01000000.00000006.sdmp, Author: unknown Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000001.00000002.1624471002.000000000121B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000001.00000002.1624471002.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	9
Start time:	22:47:56
Start date:	19/04/2024
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff7451f0000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	12
Start time:	22:48:06
Start date:	19/04/2024
Path:	C:\ProgramData\92D9.tmp
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\92D9.tmp"
Imagebase:	0x400000
File size:	14'336 bytes
MD5 hash:	294E9F64CB1642DD89229FFF0592856B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	14
Start time:	22:48:07
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\92D9.tmp >> NUL
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true