Analysis
- max time kernel
85s - max time network
32s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20251218-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20251218-enlocale:en-usos:windows10-ltsc_2021-x64system - submitted
20/12/2025, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bypass.exe
Resource
win10ltsc2021-20251218-en
windows10-ltsc_2021-x64
2 signatures
150 seconds
General
- Target bypass.exe
- Size 211KB
- Sample251220-2pcgqsymgr
- SHA256 ff0ffae4478f831cf64714f734a4f8fcf4d6c81ddfcf43e37aa026566970882a
- MD5 dc1926e90476c49859e8649f3b678f1c
- SHA1 7d8d8af0dddf80d921b1d440a6ee3bbbd4e6b016
- SHA512 befb94daea7e39fdb07e468fb4c666bf225ccb8d74a8cf00d14c751f00ccdd6a8a50956d3f8f529d5c2df6340037439a6d5f248d39c0a0035e91c55afd569f86
- SSDEEP 3072:WAD+0yxRNhJFk4swBYCa4IMMgcjzc092Px0VgIV3hhgJlhavYchw90:W0ixpJWRwBYtfcRp03V3hhgJlhkBw
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe 4920 bypass.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4920 bypass.exe