3a138fda1ec86d8795114d192613414ecc3a1702674c67da3b14ab970acfc211

Analysis

user interaction
yes
max time kernel
267s
max time network
269s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 16:26

Target
CheatEvolution/DotNetDataCollector64.exe
Size 186KB
Sample260620-txzy1ahs5t
SHA256 3a138fda1ec86d8795114d192613414ecc3a1702674c67da3b14ab970acfc211
MD5 6e4d5643ba06864ca5f9c0598cfa8c41
SHA1 32a47b05c6f2cf0403a118f130fa62700a6dc97e
SHA512 c45b7f06256bc2631e9917d636b2de3521f3e817d6fe6fa4ac3bc86fb5ccef408fd0a1a4a376bd80d2ba4fbbaef226d3877555ffb89760e61649f830ba6c49ad
SSDEEP 3072:PZ9I3HumDI7uSG009IOEMfv+K5SAgH+9gr0zKArFoeeeWA0i:PZ9qBMuSRKDEMX+qC2wti
TLSH
T115149D4A73A510F9E22BC53DCD459556E7B3B4420BA49A9F036403BADF633E09F39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	DotNetDataCollector64.exe

C:\Users\Admin\AppData\Local\Temp\CheatEvolution\DotNetDataCollector64.exe
"C:\Users\Admin\AppData\Local\Temp\CheatEvolution\DotNetDataCollector64.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4200