Trojan.Win32.Autoit.fhj MVID-2022-0638 NULL DACL

Trojan.Win32.Autoit.fhj malware creates two processes “xservice.exe” and a child process “xps.exe”. The process creates an IPC pipe with a NULL DACL allowing RW for the Everyone user group.

Leave a Reply