IOC Report

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1F0B.exe.log

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl

data

dropped

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl

data

dropped

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

data

dropped

C:\Users\user\AppData\Local\Temp\97B8.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\B729.exe

MS-DOS executable

dropped

C:\Users\user\AppData\Local\Temp\D830.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001@` (copy)

data

dropped

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 (copy)

data

dropped

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001.. (copy)

data

dropped

C:\Users\user\AppData\Roaming\aiecibh

data

dropped

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Little-endian UTF-16 Unicode text, with CRLF, CR line terminators

modified

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20220110_024703_630.etl

data

dropped

C:\Windows\SysWOW64\rhrovez\rljdetbq.exe (copy)

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\System32\SgrmBroker.exe

C:\Windows\system32\SgrmBroker.exe

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\sc.exe

C:\Windows\SysWOW64\sc.exe" create rhrovez binPath= "C:\Windows\SysWOW64\rhrovez\rljdetbq.exe /d\"C:\Users\user\AppData\Local\Temp\2B8.exe\"" type= own start= auto DisplayName= "wifi support

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\sc.exe

C:\Windows\SysWOW64\sc.exe" description rhrovez "wifi internet conection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1