donutloader | 446fda0e27f236057ce5c6720c00da778b1ddd51ee78eaaf127f3ce754fc623b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_15b747808cf4341c67e27f18f319bea4_elex_mimic_pay2key_wannacry.exe
Size 17.2MB
Sample260511-kcktxadt4x
SHA256 446fda0e27f236057ce5c6720c00da778b1ddd51ee78eaaf127f3ce754fc623b
MD5 15b747808cf4341c67e27f18f319bea4
SHA1 03357e67b784ef6c191ed72585566734daf3dcca
SHA512 020ceed5ee8b4a3537ed4ca7c53dfeb520c15c00008295364226648894c5f5130a421627eb348b5823057f7132defc9f5e0fae0092326afae179f5f47a795043
SSDEEP 98304:KB5A8GxiuoaN5zNpYU+XNSY4/3pAePUN9tk:KB/Gtt5zNaUyM/3KNP
TLSH
T1320733A63789D9B5CA6303BC1965CAB08773ED911F11D38716E0BE037A326D12EB5387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader loader persistence spyware stealer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/1292-54-0x0000022727610000-0x00000227277F5000-memory.dmp	family_donutloader

Custom signature

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/memory/1292-55-0x0000022728250000-0x0000022728436000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/memory/1292-55-0x0000022728250000-0x0000022728436000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Custom signature

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244a4-48.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/1292-49-0x000002270CCA0000-0x000002270CDB0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2760	powershell.exe
3916	powershell.exe
952	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	CoreWorker_uAiDssFFiZsYbQu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	2026-05-11_15b747808cf4341c67e27f18f319bea4_elex_mimic_pay2key_wannacry.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Repair.lnk	Updater.exe

Executes dropped EXE 8 IoCs

pid	Process
3076	7z.exe
2936	7z.exe
1536	7z.exe
1288	7z.exe
4596	7z.exe
1292	Updater.exe
1548	CoreWorker_uAiDssFFiZsYbQu.exe
1596	CoreWorker_uAiDssFFiZsYbQu.exe

Loads dropped DLL 5 IoCs

pid	Process
3076	7z.exe
2936	7z.exe
1536	7z.exe
1288	7z.exe
4596	7z.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_uAiDssFFiZsYbQu = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_uAiDssFFiZsYbQu.exe"	Updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_uAiDssFFiZsYbQu = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_uAiDssFFiZsYbQu.exe"	CoreWorker_uAiDssFFiZsYbQu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_uAiDssFFiZsYbQu = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_uAiDssFFiZsYbQu.exe"	CoreWorker_uAiDssFFiZsYbQu.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_15b747808cf4341c67e27f18f319bea4_elex_mimic_pay2key_wannacry.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Updater.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe
1292	Updater.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3076	7z.exe
Token: 35	3076	7z.exe
Token: SeSecurityPrivilege	3076	7z.exe
Token: SeSecurityPrivilege	3076	7z.exe
Token: SeRestorePrivilege	2936	7z.exe
Token: 35	2936	7z.exe
Token: SeSecurityPrivilege	2936	7z.exe
Token: SeSecurityPrivilege	2936	7z.exe
Token: SeRestorePrivilege	1536	7z.exe
Token: 35	1536	7z.exe
Token: SeSecurityPrivilege	1536	7z.exe
Token: SeSecurityPrivilege	1536	7z.exe
Token: SeRestorePrivilege	1288	7z.exe
Token: 35	1288	7z.exe
Token: SeSecurityPrivilege	1288	7z.exe
Token: SeSecurityPrivilege	1288	7z.exe
Token: SeRestorePrivilege	4596	7z.exe
Token: 35	4596	7z.exe
Token: SeSecurityPrivilege	4596	7z.exe
Token: SeSecurityPrivilege	4596	7z.exe
Token: SeDebugPrivilege	1292	Updater.exe
Token: SeDebugPrivilege	1292	Updater.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	1548	CoreWorker_uAiDssFFiZsYbQu.exe
Token: SeDebugPrivilege	1548	CoreWorker_uAiDssFFiZsYbQu.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2760	powershell.exe
Token: SeSecurityPrivilege	2760	powershell.exe
Token: SeTakeOwnershipPrivilege	2760	powershell.exe
Token: SeLoadDriverPrivilege	2760	powershell.exe
Token: SeSystemProfilePrivilege	2760	powershell.exe
Token: SeSystemtimePrivilege	2760	powershell.exe
Token: SeProfSingleProcessPrivilege	2760	powershell.exe
Token: SeIncBasePriorityPrivilege	2760	powershell.exe
Token: SeCreatePagefilePrivilege	2760	powershell.exe
Token: SeBackupPrivilege	2760	powershell.exe
Token: SeRestorePrivilege	2760	powershell.exe
Token: SeShutdownPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeSystemEnvironmentPrivilege	2760	powershell.exe
Token: SeRemoteShutdownPrivilege	2760	powershell.exe
Token: SeUndockPrivilege	2760	powershell.exe
Token: SeManageVolumePrivilege	2760	powershell.exe
Token: 33	2760	powershell.exe
Token: 34	2760	powershell.exe
Token: 35	2760	powershell.exe
Token: 36	2760	powershell.exe
Token: SeIncreaseQuotaPrivilege	2760	powershell.exe
Token: SeSecurityPrivilege	2760	powershell.exe
Token: SeTakeOwnershipPrivilege	2760	powershell.exe
Token: SeLoadDriverPrivilege	2760	powershell.exe
Token: SeSystemProfilePrivilege	2760	powershell.exe
Token: SeSystemtimePrivilege	2760	powershell.exe
Token: SeProfSingleProcessPrivilege	2760	powershell.exe
Token: SeIncBasePriorityPrivilege	2760	powershell.exe
Token: SeCreatePagefilePrivilege	2760	powershell.exe
Token: SeBackupPrivilege	2760	powershell.exe
Token: SeRestorePrivilege	2760	powershell.exe
Token: SeShutdownPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeSystemEnvironmentPrivilege	2760	powershell.exe
Token: SeRemoteShutdownPrivilege	2760	powershell.exe
Token: SeUndockPrivilege	2760	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 5040	972	2026-05-11_15b747808cf4341c67e27f18f319bea4_elex_mimic_pay2key_wannacry.exe	85
PID 5040 wrote to memory of 5764	5040	cmd.exe	87
PID 5040 wrote to memory of 3076	5040	cmd.exe	88
PID 5040 wrote to memory of 2936	5040	cmd.exe	89
PID 5040 wrote to memory of 1536	5040	cmd.exe	90
PID 5040 wrote to memory of 1288	5040	cmd.exe	91
PID 5040 wrote to memory of 4596	5040	cmd.exe	92
PID 5040 wrote to memory of 2160	5040	cmd.exe	93
PID 5040 wrote to memory of 1292	5040	cmd.exe	94
PID 1292 wrote to memory of 3968	1292	Updater.exe	96
PID 1292 wrote to memory of 3996	1292	Updater.exe	97
PID 1292 wrote to memory of 3968	1292	Updater.exe	96
PID 1292 wrote to memory of 3996	1292	Updater.exe	97
PID 1292 wrote to memory of 4812	1292	Updater.exe	100
PID 4812 wrote to memory of 3916	4812	cmd.exe	102
PID 1292 wrote to memory of 1548	1292	Updater.exe	103
PID 1548 wrote to memory of 2760	1548	CoreWorker_uAiDssFFiZsYbQu.exe	104
PID 1548 wrote to memory of 5024	1548	CoreWorker_uAiDssFFiZsYbQu.exe	106
PID 5024 wrote to memory of 952	5024	cmd.exe	108

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2160	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-11_15b747808cf4341c67e27f18f319bea4_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_15b747808cf4341c67e27f18f319bea4_elex_mimic_pay2key_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\system32\mode.com
    mode 65,10
    3⤵
    PID:5764
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e file.zip -p1395114089652129610602112253 -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3076
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_4.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_3.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_2.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_1.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- - C:\Windows\system32\attrib.exe
    attrib +H "Updater.exe"
    3⤵
    - Views/modifies file attributes
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\main\Updater.exe
    "Updater.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3996
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3916
  - - C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_uAiDssFFiZsYbQu.exe
      "C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_uAiDssFFiZsYbQu.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_uAiDssFFiZsYbQu.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_uAiDssFFiZsYbQu-1597' -RunLevel Highest "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5024
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2400

C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_uAiDssFFiZsYbQu.exe
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_uAiDssFFiZsYbQu.exe
1⤵
- Executes dropped EXE
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 1079452300e8e881b2663f8eb38edad62321e88e4ec70de709f8d1be96797c21
MD5 3d7378bf1866a4b62e4bd4b15bf8a676
SHA1 a13b4f0ef14768ccf4a705a0303dec6846e6ae9c
SHA512 d926cb589c43e63379a61d80798ef529f140984dd4fc83a67cd5949750b0b277d22383750f8d477811207f8dab9eedc6d84278e02ad7679efd2d88b3449f6982
TLSH
T1B6114563F78C8920CC96163A509DAC5172B686CB81AFDF9F7FC0C210E1BF584CB61694
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c0c37fd6fb26d101e347a1e9b5190029bb591d8c57392dbf2df4741b11fc2dfa
MD5 cc2ce575753731574bf10ff6e5162032
SHA1 b660e5156f97af770e5d359fdd2a6ea697f359fb
SHA512 715bb49c3977d51ff39b0458b99c5e3ba786e3110a4015402cd023b484ff385704475238fb813d074524d76bc733b0d4e92b57b64d187b3d6a664e4f38eebc1b
TLSH
T130217823B39D8820CCD5163A108D9C5072A682C781DFCF9F2EC0C21191BFAC8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

CoreWorker_uAiDssFFiZsYbQu.exe

Path C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_uAiDssFFiZsYbQu.exe
Size 13KB
SHA256 26f5da8506e000681e9658af3572fdcf7a8a0e8dbcc315bc63f68e1301b986a1
MD5 6eb27bb4ac12fea3710797eaa387192c
SHA1 770019d72f4a11957695aed4a39868ab1b47648d
SHA512 50cced8d5a969fc5c7c5870553610405e7a0cf2dbdcc42757586be852f23a3d8d50ae0804a0e2922c3baabdea60fa502cebb5dcf0e95c3dbc37f04412011f443
SSDEEP 192:o3ED4poDaVm2iJJdMBizTcPKw+rmbQSaZxGKxOkhEVVEMKRDTQ7W7vm:uEyVmciw+rmbQSgxLQR/EMKxgW7v
TLSH
T1DC52D804A7E48139D6BA0F749EB265105A33F7564932CE1F258C928B5B27380EDE2F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4usgdnzx.iby.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4usgdnzx.iby.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
Size 1.6MB
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
TLSH
T148754B6BF6748260D0B7C075C5D2AB96EEB134868B3096C752859B3D2F17BF6C939320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
TLSH
T10BA40815F6748631D073D0BAC5D3AA9AEE3230855B308ACB1286D7782F277E6C936731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Updater.exe

Path C:\Users\Admin\AppData\Local\Temp\main\Updater.exe
Size 1.0MB
SHA256 30a69ebcfce22e0a4944730a59d5ee1bcbd4ae5fe65687dafa540d2e7d9778ea
MD5 d2a75acfccac69f196cde58a3ebb278c
SHA1 dc59342b304702f04f9f465ab15404535d14f943
SHA512 db7dedb1c4da81caf53f914f98ae425096792b019b9ae694dc66e20e02b0c5836cfc6225dd9aad8bc5f6db6af1d04b17ac250d811c72c1fc2d54df17a4cb06e5
SSDEEP 24576:eXgCOX6eCAblLznOnK4s8UdF7asuBPL2XV9:eXgCC7b4c3bavj2X
TLSH
T16535CF0527E6DE01E23E637D406482C843FDA9045D86DF5693E53AFB2BCE392EB1614B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ANTIAV~1.DAT

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
Size 2.3MB
SHA256 fcdf109fb9fa0a0b1fd144485b6ea5cf2a5240f26ef83b7cc0385cc3a8137d84
MD5 6a55c444121a04447c71197c480321ad
SHA1 d379ed3135fe3ddd64cf465163415b2c7c5d7d2f
SHA512 b58e2814a2e3b856a17e7ba729e5b8d95060089c0e2de62e195d1fc4f98c2fd518b5e25ff566750f3f41f8a57f4032ebf48a594cb9bfe518e76c84f68ba5d0cc
SSDEEP 24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xK:R9kqGu7okoZscCnf0/Zs9L
TLSH
T1BEB501E4B7C8BCC68B9E93D7A1518EAE133311FB9993548C0586BBC91E1B785DF1C884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_1.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
Size 770KB
SHA256 2f878444723205f387783f3700e2072407b4a0df736b104eeda83e39a8a6f028
MD5 4dbcdf568c451801f12457bbdb296e61
SHA1 2aa1d0fe9cabcd510991cd34764da75d58f23cb0
SHA512 000ee749808274839ef9be2b8bfe5bee143b4f7d4503902e74d4310dc6a087311bd662b6e0e4fee748aeb960524663b92b576a10211eee060512ed6baea2739f
SSDEEP 24576:bOX88cuXsxvvgRZ6nC671UWgBFnj6krckx:bCLcxHcm1U7vttx
TLSH
T163F433EF1FC5468393061C99BD239A3F795490C3522AAC526E59F025287C9E3D34B1EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_2.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
Size 770KB
SHA256 ce153a984ef45091eb34478e6a0ac72184dcea951ef1f94c8d15874506f2f270
MD5 3354eea67dfd25452bae4511f0d0d6f0
SHA1 5f739a96f83c3029a4bebe55d48c4f68ca7f06f9
SHA512 66295216cf81825eac92c64cb6bcb7fb0b4e9e5d2b9ab43d1f98ccb81364a895724200ff1f1f3b27c598d775579d3a6490bbc82a6d83daab380b5e1df0aec86a
SSDEEP 24576:MOX88cuXsxvvgRZ6nC671UWgBFnj6krckA:MCLcxHcm1U7vttA
TLSH
T133F433AF1FC5468393060C99BD279A3F795490C3522AAC526E99F0212C7C9E3D74B1EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_3.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
Size 770KB
SHA256 46d3f2fdcf4b80a67d683394351cb275caff03b5988ea4d1ce7f4fdad40f819a
MD5 8c15b2c50866363ca58011ca2c417cab
SHA1 4a8d367dbec18780c626619864fd35e4ac67f171
SHA512 bb538cb73ac665f5844333210647c2d3b7925990334dbbbf3cd6e338696bebbe3b648df4f76b1e6610c5ea54962563eb86a05f18df2f5ad48ff89c5d7f7d2a87
SSDEEP 24576:0OX88cuXsxvvgRZ6nC671UWgBFnj6krck0:0CLcxHcm1U7vtt0
TLSH
T1B3F433AF1FC5468393061C99BD239A3F795490C3522AAC526E99F0212C7C9E3D74B1EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_4.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
Size 2.4MB
SHA256 668b0195bf459b849bce15bb90cdf21d0a299bebccb85191e43dd59e47874f75
MD5 aeb4a12b45ac7ea963ae7cc3204eec5d
SHA1 62292ee821e1f9fd0837164ffde4dc83cce28990
SHA512 fc2338b442a8efbf4f7b14a1a0e62f67e3cb0423faea6a7de8444de2fcb5729217486005394fbbf4c2b2e2f838378e4bf0978bf53a6e94e3ee56c0a67048e168
SSDEEP 49152:4ujCK3D0AC/l5mwbBkDWYb1ZN4UJ9oYLCLcxHcm1U7vtth:4aR3D0Ae5mwdkDWm1Xo+8gFUBth
TLSH
T1B3C5334D08B68BF7EA152C381D2BC622A973A0F2621B59F52DCC310415BD5BEAD4E13F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.bin

Path C:\Users\Admin\AppData\Local\Temp\main\file.bin
Size 2.4MB
SHA256 4ec5cfd0553ca9165f5021602d8c5d1231e88c779b36d88a570369039dd0012f
MD5 2d60b08c42670880710861c4faed33cd
SHA1 f38c55a98a30f8222f3b2816e0b364c94a645b90
SHA512 8dfe8f6308f6925357fd5c6385a26987eee68ed0221aa64e446145dcc30dcc93c65c07223363f351895e0fd7a9cfb6642500d4777f57f4b876983ec5d4cd5168
SSDEEP 49152:x/pTEO+hj4+9pcYwXl/7PYN3fcA9DQOyF/Ern3i5Aq2/NsEe:bTIhj4aZEhsn3uAq2/WEe
TLSH
T14EC533AAD2347FA4C1BDDA7C8684F563AC43CD7AB8F3165E4A018CE1205B05B357B66C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.bat

Path C:\Users\Admin\AppData\Local\Temp\main\main.bat
Size 464B
SHA256 75fb0befa04df727eba0d58863592ec246bf163d4ccf5928aa3b5a4940212a27
MD5 a9270718ee710487a6b319b05f59438f
SHA1 113df2464ee013a139283c8e6e2fe1b0e57c716f
SHA512 186bb4b291d9753b02f6649e6b38019b631404a009c68885078f416d9f44627fc3b6767d543c7ef74fe8b7a8ff2aafd4ab6fe1813a9fda1e702dcb88b7665643
TLSH
T1D7F0274024C7C9B24CD5268A07882DD67527945AC12F4F002AE000EE64198DCD4CBFAB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/952-114-0x0000027071030000-0x000002707103C000-memory.dmp

Download

memory/972-130-0x00000000008B0000-0x000000000096F000-memory.dmp

Download

memory/972-124-0x00000000008B0000-0x000000000096F000-memory.dmp

Download

memory/972-123-0x00000000008B0000-0x000000000096F000-memory.dmp

Download

memory/972-121-0x00000000008B0000-0x000000000096F000-memory.dmp

Download

memory/972-75-0x00000000008B0000-0x000000000096F000-memory.dmp

Download

memory/1292-57-0x0000022727A70000-0x0000022727A82000-memory.dmp

Download

memory/1292-55-0x0000022728250000-0x0000022728436000-memory.dmp

Download

memory/1292-51-0x0000022727440000-0x0000022727602000-memory.dmp

Download

memory/1292-52-0x0000022727270000-0x00000227272E6000-memory.dmp

Download

memory/1292-53-0x0000022727B40000-0x0000022728068000-memory.dmp

Download

memory/1292-76-0x000002270E900000-0x000002270E90C000-memory.dmp

Download

memory/1292-49-0x000002270CCA0000-0x000002270CDB0000-memory.dmp

Download

memory/1292-96-0x000002270E900000-0x000002270E90C000-memory.dmp

Download

memory/1292-54-0x0000022727610000-0x00000227277F5000-memory.dmp

Download

memory/1292-63-0x0000022727A90000-0x0000022727AE0000-memory.dmp

Download

memory/1292-50-0x000002270E8F0000-0x000002270E8F1000-memory.dmp

Download

memory/1548-95-0x0000026D92F40000-0x0000026D92F4A000-memory.dmp

Download

memory/2760-119-0x0000023600060000-0x000002360006C000-memory.dmp

Download

memory/3916-74-0x00000219BC3D0000-0x00000219BC3DC000-memory.dmp

Download

memory/3916-69-0x00000219D47E0000-0x00000219D4802000-memory.dmp

Download

memory/3968-58-0x0000024741DE0000-0x0000024741DF0000-memory.dmp

Download

memory/3996-59-0x0000025E25040000-0x0000025E25050000-memory.dmp

Download

memory/3996-60-0x0000025E26870000-0x0000025E2688E000-memory.dmp

Download