donutloader | a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19

Analysis

max time kernel
149s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
Size 1020KB
Sample260722-w4ebzssamd
SHA256 a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19
MD5 8a135aadedb0ee518d3f47ffba65b79a
SHA1 a456eacab4c267643e7a8942e03a8b1802b66dfa
SHA512 70c290f3904db8ecd8c6f65d65123913126e18c7be36e06e501aa9db8bb3f52320f9ec01045e07adee08c59e038d8b7c4068b6d6e698738e64aeb7c2135f97a9
SSDEEP 24576:c2qhwlsCakI3vvhCGpgpCedZWMkt+DzcnQC3ua:pqSYRCGcQQnGh
TLSH
T1EA2533A1674128A4C6B9E57682A0F7B74642F960126E363CC6F163793F3CD724ECC927
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence spyware stealer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/616-0-0x0000024A1B2B0000-0x0000024A1B3A9000-memory.dmp	family_donutloader
behavioral2/memory/616-19-0x0000024A360C0000-0x0000024A36306000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
832	powershell.exe
3748	powershell.exe
4328	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Repair.lnk	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe

Executes dropped EXE 2 IoCs

pid	Process
2544	CoreWorker_DGjJvQEGRrzkKrv.exe
4276	CoreWorker_DGjJvQEGRrzkKrv.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_DGjJvQEGRrzkKrv = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_DGjJvQEGRrzkKrv.exe"	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_DGjJvQEGRrzkKrv = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_DGjJvQEGRrzkKrv.exe"	CoreWorker_DGjJvQEGRrzkKrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_DGjJvQEGRrzkKrv = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_DGjJvQEGRrzkKrv.exe"	CoreWorker_DGjJvQEGRrzkKrv.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4408	cmd.exe
2596	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3156	chrome.exe
5092	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
Token: SeDebugPrivilege	616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeCreatePagefilePrivilege	1008	chrome.exe
Token: SeDebugPrivilege	832	powershell.exe
Token: SeIncreaseQuotaPrivilege	832	powershell.exe
Token: SeSecurityPrivilege	832	powershell.exe
Token: SeTakeOwnershipPrivilege	832	powershell.exe
Token: SeLoadDriverPrivilege	832	powershell.exe
Token: SeSystemProfilePrivilege	832	powershell.exe
Token: SeSystemtimePrivilege	832	powershell.exe
Token: SeProfSingleProcessPrivilege	832	powershell.exe
Token: SeIncBasePriorityPrivilege	832	powershell.exe
Token: SeCreatePagefilePrivilege	832	powershell.exe
Token: SeBackupPrivilege	832	powershell.exe
Token: SeRestorePrivilege	832	powershell.exe
Token: SeShutdownPrivilege	832	powershell.exe
Token: SeDebugPrivilege	832	powershell.exe
Token: SeSystemEnvironmentPrivilege	832	powershell.exe
Token: SeRemoteShutdownPrivilege	832	powershell.exe
Token: SeUndockPrivilege	832	powershell.exe
Token: SeManageVolumePrivilege	832	powershell.exe
Token: 33	832	powershell.exe
Token: 34	832	powershell.exe
Token: 35	832	powershell.exe
Token: 36	832	powershell.exe
Token: SeDebugPrivilege	2544	CoreWorker_DGjJvQEGRrzkKrv.exe
Token: SeDebugPrivilege	2544	CoreWorker_DGjJvQEGRrzkKrv.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeIncreaseQuotaPrivilege	3748	powershell.exe
Token: SeSecurityPrivilege	3748	powershell.exe
Token: SeTakeOwnershipPrivilege	3748	powershell.exe
Token: SeLoadDriverPrivilege	3748	powershell.exe
Token: SeSystemProfilePrivilege	3748	powershell.exe
Token: SeSystemtimePrivilege	3748	powershell.exe
Token: SeProfSingleProcessPrivilege	3748	powershell.exe
Token: SeIncBasePriorityPrivilege	3748	powershell.exe
Token: SeCreatePagefilePrivilege	3748	powershell.exe
Token: SeBackupPrivilege	3748	powershell.exe
Token: SeRestorePrivilege	3748	powershell.exe
Token: SeShutdownPrivilege	3748	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeSystemEnvironmentPrivilege	3748	powershell.exe
Token: SeRemoteShutdownPrivilege	3748	powershell.exe
Token: SeUndockPrivilege	3748	powershell.exe
Token: SeManageVolumePrivilege	3748	powershell.exe
Token: 33	3748	powershell.exe
Token: 34	3748	powershell.exe
Token: 35	3748	powershell.exe
Token: 36	3748	powershell.exe
Token: SeIncreaseQuotaPrivilege	4328	powershell.exe
Token: SeSecurityPrivilege	4328	powershell.exe
Token: SeTakeOwnershipPrivilege	4328	powershell.exe
Token: SeLoadDriverPrivilege	4328	powershell.exe
Token: SeSystemProfilePrivilege	4328	powershell.exe
Token: SeSystemtimePrivilege	4328	powershell.exe
Token: SeProfSingleProcessPrivilege	4328	powershell.exe
Token: SeIncBasePriorityPrivilege	4328	powershell.exe
Token: SeCreatePagefilePrivilege	4328	powershell.exe
Token: SeBackupPrivilege	4328	powershell.exe
Token: SeRestorePrivilege	4328	powershell.exe
Token: SeShutdownPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1008	chrome.exe
1008	chrome.exe
1040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 5768	616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe	90
PID 616 wrote to memory of 5768	616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe	90
PID 616 wrote to memory of 572	616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe	108
PID 616 wrote to memory of 572	616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe	108
PID 616 wrote to memory of 1008	616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe	94
PID 1008 wrote to memory of 3668	1008	chrome.exe	95
PID 1008 wrote to memory of 3060	1008	chrome.exe	96
PID 1008 wrote to memory of 3156	1008	chrome.exe	97
PID 1008 wrote to memory of 3060	1008	chrome.exe	96
PID 1008 wrote to memory of 2536	1008	chrome.exe	98
PID 1008 wrote to memory of 2536	1008	chrome.exe	98
PID 1008 wrote to memory of 4088	1008	chrome.exe	99
PID 1008 wrote to memory of 4088	1008	chrome.exe	99
PID 1008 wrote to memory of 5124	1008	chrome.exe	100
PID 1008 wrote to memory of 5124	1008	chrome.exe	100
PID 1008 wrote to memory of 4292	1008	chrome.exe	101
PID 1008 wrote to memory of 4208	1008	chrome.exe	102
PID 1008 wrote to memory of 4292	1008	chrome.exe	101
PID 1008 wrote to memory of 4208	1008	chrome.exe	102
PID 1008 wrote to memory of 2064	1008	chrome.exe	103
PID 1008 wrote to memory of 2064	1008	chrome.exe	103
PID 616 wrote to memory of 1040	616	a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe	104
PID 1040 wrote to memory of 1944	1040	msedge.exe	105
PID 1040 wrote to memory of 5092	1040	msedge.exe	106
PID 1040 wrote to memory of 5992	1040	msedge.exe	107
PID 1040 wrote to memory of 5992	1040	msedge.exe	107
PID 1040 wrote to memory of 5992	1040	msedge.exe	107
PID 1040 wrote to memory of 572	1040	msedge.exe	108
PID 1040 wrote to memory of 572	1040	msedge.exe	108
PID 1040 wrote to memory of 1404	1040	msedge.exe	109
PID 1040 wrote to memory of 1404	1040	msedge.exe	109
PID 1040 wrote to memory of 1404	1040	msedge.exe	109
PID 1040 wrote to memory of 824	1040	msedge.exe	110
PID 1040 wrote to memory of 824	1040	msedge.exe	110
PID 1040 wrote to memory of 824	1040	msedge.exe	110
PID 1040 wrote to memory of 3404	1040	msedge.exe	111
PID 1040 wrote to memory of 4340	1040	msedge.exe	112
PID 1040 wrote to memory of 2456	1040	msedge.exe	113
PID 1040 wrote to memory of 1244	1040	msedge.exe	114
PID 1040 wrote to memory of 2800	1040	msedge.exe	115
PID 1040 wrote to memory of 4940	1040	msedge.exe	116
PID 1040 wrote to memory of 5616	1040	msedge.exe	117
PID 1040 wrote to memory of 2400	1040	msedge.exe	118
PID 1040 wrote to memory of 1244	1040	msedge.exe	114
PID 1040 wrote to memory of 1244	1040	msedge.exe	114
PID 1040 wrote to memory of 4228	1040	msedge.exe	119
PID 1040 wrote to memory of 4580	1040	msedge.exe	120
PID 1040 wrote to memory of 3688	1040	msedge.exe	121
PID 1040 wrote to memory of 2800	1040	msedge.exe	115
PID 1040 wrote to memory of 2800	1040	msedge.exe	115
PID 1040 wrote to memory of 4940	1040	msedge.exe	116
PID 1040 wrote to memory of 4940	1040	msedge.exe	116
PID 1040 wrote to memory of 1428	1040	msedge.exe	122
PID 1040 wrote to memory of 5616	1040	msedge.exe	117
PID 1040 wrote to memory of 6108	1040	msedge.exe	123
PID 1040 wrote to memory of 5616	1040	msedge.exe	117
PID 1040 wrote to memory of 2400	1040	msedge.exe	118
PID 1040 wrote to memory of 2400	1040	msedge.exe	118
PID 1040 wrote to memory of 4228	1040	msedge.exe	119
PID 1040 wrote to memory of 4228	1040	msedge.exe	119
PID 1040 wrote to memory of 4580	1040	msedge.exe	120
PID 1040 wrote to memory of 4580	1040	msedge.exe	120
PID 1040 wrote to memory of 3688	1040	msedge.exe	121
PID 1040 wrote to memory of 3688	1040	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe
"C:\Users\Admin\AppData\Local\Temp\a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq" --app=http://127.0.0.1:49873
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc0d93c728,0x7ffc0d93c734,0x7ffc0d93c740
    3⤵
    PID:3668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,9946281014808648937,10082608618794390503,262144 --field-trial-handle=2020,i,10304827903338917266,4997165444544274226,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:3060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq" --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,3483057958752013155,12388781227602151160,524288 --field-trial-handle=2020,i,10304827903338917266,4997165444544274226,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq" --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,5681096445283242172,6618509929656054589,524288 --field-trial-handle=2020,i,10304827903338917266,4997165444544274226,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:13
    3⤵
    PID:2536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,449644123084975007,9723728136668204304,2097152 --field-trial-handle=2020,i,10304827903338917266,4997165444544274226,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:4088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,12643267351151202359,4059069181200275121,2097152 --field-trial-handle=2020,i,10304827903338917266,4997165444544274226,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:5124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3796,i,6179776655647535990,10830469836727102258,2097152 --field-trial-handle=2020,i,10304827903338917266,4997165444544274226,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
    3⤵
    PID:4292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3852,i,17834455752356998716,4085091455701385828,2097152 --field-trial-handle=2020,i,10304827903338917266,4997165444544274226,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:9
    3⤵
    PID:4208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4500,i,16621369152302046331,11077139314253207420,2097152 --field-trial-handle=2020,i,10304827903338917266,4997165444544274226,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:9
    3⤵
    PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --app=http://127.0.0.1:50056
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc0bcdc188,0x7ffc0bcdc194,0x7ffc0bcdc1a0
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,16168364133877686493,3091217142009838762,524288 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,18300336832067939769,10031121298961412360,262144 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,12331483197436060277,10572256474181814715,524288 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:13
    3⤵
    PID:572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,14402697366834213230,11540827966498347922,2097152 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,14039444389821660840,2873182779633807783,2097152 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,14188690702575670855,45008290176278942,524288 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,13403534083793300554,12318204768569736736,524288 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,5244613579815492198,6185856630073907529,524288 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4208,i,15244076269810892335,9685645221839469452,2097152 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4240,i,5518272949698876729,7786759327446660640,2097152 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:9
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4264,i,13469206594116258398,11688352026569763501,2097152 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4320,i,159763616973199037,2454612518440427123,2097152 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4348,i,13262499091953244142,7015993862201688530,2097152 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4352,i,17746610187108549127,1862156920309926170,2097152 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:9
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4376,i,11210365360992402886,8974414999764412871,2097152 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:9
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4356,i,15198863217567575856,6957563066831983896,2097152 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4536,i,13102039754457177194,9277722196927317599,2097152 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4592,i,1905275358608108771,16729545509638667973,2097152 --field-trial-handle=2528,i,18181154343777950310,10252327862903700554,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:9
    3⤵
    PID:6108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
  2⤵
  - Executes a command shell one-liner
  PID:4408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:832
- C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_DGjJvQEGRrzkKrv.exe
  "C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_DGjJvQEGRrzkKrv.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_DGjJvQEGRrzkKrv.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_DGjJvQEGRrzkKrv-3859' -RunLevel Highest "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
    3⤵
    - Executes a command shell one-liner
    PID:2596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4300

C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_DGjJvQEGRrzkKrv.exe
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_DGjJvQEGRrzkKrv.exe
1⤵
- Executes dropped EXE
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CoreWorker_DGjJvQEGRrzkKrv.exe

Path C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_DGjJvQEGRrzkKrv.exe
Size 13KB
SHA256 3053df9410aec2282da832125e138823efe0627359571c4c3aa071207ddfc441
MD5 5680b4273265e87aa3572bca3e1bcedb
SHA1 ba1af987fe3deb793e488e245e03cba898515275
SHA512 47e6fc09ca178cb3727711b9305725f3e302680ed8fc36422cbad22c9242618b074e3bb7408768708cd9c2268d61ecd58763c53b72d31163e1232a80f7f42a86
SSDEEP 192:REDnedF1DTHoKiTizMVhmHGjrmbQSaZxGKTOkhE8VOLcCIRDTQEW7vm:REA1D8KiuRGjrmbQSgxLiRmO4/xnW7v
TLSH
T11352D704B7E18125E5BA4B79EEF351105A33FB625932CE1E14CC528B0B27681ADE2F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_05ja3tqv.3k0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_05ja3tqv.3k0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Crashpad\settings.dat
Size 40B
SHA256 7500113d15848f93e5a88ae4ac3509038fc0fc68b8ea33c50bb9adda74b27534
MD5 90b831daf393d10b341ceea457e7dd08
SHA1 516e9e4ab98154a857c44bd61bb52549cd155ed1
SHA512 a517bf0b5372f1324a2d9e0da8c886f918b6d4f3b8dfa6b09b4691e8ec18f7a82610fcd8862efe1ecc44bfb482561f91103c2d342c144458607664c4ff92b91c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 5f22d617bbf2cf73b57e0c438c1b8f2b90b8dca800bbab4188612f7edebaf30e
MD5 0c24b201e5a2cfe3ec0101f881c39496
SHA1 612380cb1b72feede3b3991186c505a4e5437d69
SHA512 a78ceb2e338fbd80829f56e90a761a444052f6f635672108b121ab04c0fec488846be2b7b3f5f0780446adbaeea729cd2524b91c4774220bf6d02f45b24bb5d3
SSDEEP 3:MsFl9tlGallp1oQRUul1ikellcKxdAQLll1/1VeQko5onNbltl1O71:/F3XGu3Wq1ikez8QD12Qko2nNbltW7
TLSH
T17A13487FA9C90C4AF52927B8F0279B71333185139B614247527138216A093931119626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 073bdab17de3e8aef27793dfaec7f989bfe04ae0c9b50e2f335748d3598bb70e
MD5 3fe45c21a9bc070f3d0e35559e3975e4
SHA1 be32080f765b259720ad60cd0e91a1d1e73c3f31
SHA512 031f4313e93f54f8bab396c934af3b9adc8a578bdfb0f4c2f6d6134cc58bc77764fc4e11357d1fec98b88a1af33e11c9166c15cc40ea01ef98d7dd4fb7cd2eef
SSDEEP 12:U/MmXAQ+XUlWpqp9ikuHpg6yhZBDl90IR2jBAmkV0y+BmM:JmlG03BDb1R4BAmkr+BmM
TLSH
T13544ACF799C09A85E32A47B965F3B234F437C1C02D8A4E8DB5301D740D24A421414341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Cache\Cache_Data\index
Size 256KB
SHA256 11d4cb048d31925cde5e0d672deabbcbe71641e5e4ca5aade65ae626bdf66c5e
MD5 bbcf9df20b84ab41166883ae81b1a5c4
SHA1 aeacac724ade53f7de2724ee8149605f3aaf045c
SHA512 b2d3d1a757495b053e627af9ed9cabfc790339f765959fc0831551e35e3b42b4d711150b875d9eb72817fe88d0c8520c2e21455a6a2f06f3d6d58de98006c32e
SSDEEP 3:LsOlNllklkXl47NXl//e11n/lXlWlXl2Ntl:LsK3lP47L/5ON
TLSH
T17944022E43C10C16D9C0137C8443D3301324C055CB0FC347130441311DC3BD40F8D441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 a7342f8ae1abcf0d76e02d99e9f8dcf2f5f03b6ad5e57f499be1954c914a97db
MD5 c85f24131ac7a60cc4703eaf08bdbd49
SHA1 9a12c395010d30af7994878a0a9391a250a8277b
SHA512 5f695c998b6e914056cf21ba4ae61ca2d42fa4bd703cd1ee1b64dd396cd944dc88381cef7fc83f72a615e557723231b95110a6e6ef6e4d973a1ee4309fb24777
TLSH
T196E02B81834D0F0DD33D97F7CDA603054A0E42C429BF3603A880C2C273124381248223
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6f1adea85db3c1358624370cdd71b69574782fe473c3cebe96b2db55859e09c1
MD5 b32814f84ed67f1d611fc8297dd0f2d9
SHA1 e3c02186c3e6037f4bec4ec4ae874bad6208bfd0
SHA512 b67afa817e42911437a0c8ae5bc2a44184d5cdc51ff53d500e1bdf45f3d5dcc14cafadc030c2f98e9576ea805b196902d71d7d49672261148847de9e0a92737f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 c5a7b41bc7f0f0604639541839f9860bb0527e602d88d9237db1d1ce9449739c
MD5 460dadb7b35e37993256a40f70c888ae
SHA1 094765f769587b560b1a902383f6603ea04ae49a
SHA512 97a183a5becc3525fa7cef16a08fda3d43ab3c69bda9d493646c2ac110ace06b65252a9fb2f24f3ae189e2cc906927774e35880f2a232b531a8838ae6053c93d
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\DawnGraphiteCache\index
Size 256KB
SHA256 890ce02d897d56322597e8e633f581d02b56f44211622c76b38cd73058bcb805
MD5 98932510fd9bc5cafd02728783b823fd
SHA1 ac0b00739929323f24d748530ab4749fb9cf0a82
SHA512 878abf84d5f4bbec05498632d38af2b357632b7f3b19dbe37cd555b5ea47c1df2eed44e2b9d242c5877757512f466f3cce7d07ee8b05ababb7ddced7ed71433e
SSDEEP 3:LstlNllklkXlf3lll:LsX3lPfPl
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\DawnWebGPUCache\index
Size 256KB
SHA256 441e8e924599f72b3edda96cff96c65938f1cb53e02744dca586a3b95a7b1c50
MD5 c2c2c863b19a14c4c2eb4136cf6b49d4
SHA1 e46e498e9858d2d5752fcdc286b7b4b14e220787
SHA512 f75e6e718d2e79270df410b779856d42c679180c0d8f308ff117a72158ae540ee85cdac1b2989e3681df10de58f39c2e38e6e45986636f3bfe2bf063d5c2ec55
SSDEEP 3:LstlNllklkXlG3lll:LsX3lPKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\GPUCache\index
Size 256KB
SHA256 ab7256ab653c1b4b4c78c9288ee4e6ba9eeb2b888c853ea189f46c094f10fa4c
MD5 3ca9da0aa15f3e0d3235f335886624ff
SHA1 70e30b1bdcf23e6bff71469a98dd641f5b8b3c82
SHA512 de84585fae790d0b4cc4e62491630a4e19c2ca97a03116a8da3df7d70b0077c15cbb4006c4ba97ee92e4783e3c6dbf0e2c49890f859a7f868fbb7c43f23e4c76
SSDEEP 3:LstlNllklkXlhNyo3lll:LsX3lPWYl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Preferences
Size 3KB
SHA256 ddc799161ff29e588a051646b7190e54a6217c31ed44b726feac0c9c275ff00e
MD5 ec4ead849493f323cc44784e02ecaf99
SHA1 819af365c464396e3d1a58f7c390bc5ad6d41789
SHA512 9e5b66f67139d935e0ba92db788297ffae8864b992e0a24f0bed16adcbb61e514b74e792c99fbaad0bef3c9f14bfd328a7b81adb53f126aab223d4475175fd10
TLSH
T1A861616DD1704CBB0DF23B64B43E0B83FA91463B1544281A797E4A8C5FF99AB4190FA6
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 520c39a3a44517be2a30870bcf9b317fddb364084d90a4e825668cb1cc3216ea
MD5 cfd946c13265d6821a5af9135c95a105
SHA1 f39b726ad99d02d27c17bbaebcc44986d45dcab1
SHA512 9b7b7672eba6edf59196173cdc0d5bed4ed7d4ddfab3f68512ee51b018588238b2870c59af7d39e07bcb0882b7847e5706a9f9cb6c82cead91f3b8a7eca7e671
TLSH
T1C0A0025502808250D6004BF06D15D3882201BD368104032376D443968CA44508921559
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 a8399661afb06af6d094930a96b5304f4cef694438952522abf3eda27cdd8955
MD5 161d8e44a18d8703f0c3ef7ea68ecb17
SHA1 535c6f59ad7e0b66db053abed59fb1d7976ea627
SHA512 a03c8b7ac3b01be0ae90afe880c53d2dfbee919bebb74b151c7ee7df6236964d39ce8eb72e46ebe5584d90fac64d3fc58f30294f1193733108c83e8ae714a9ac
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\GrShaderCache\index
Size 256KB
SHA256 54598f135dac9168b470b64984338b0e524deb35a4066b81b77800fba295e798
MD5 660ccc14cecd3575a58c8b05e2baf597
SHA1 02a5522d6479663d4fd991abef61215d45a05b30
SHA512 ac7e5997a2632c961acf5c9c4e1558b43cd8e9f82423703ab8446276efe7f208e1acf812fba544b648537c17845f4d92b42a6e81acaf173e25705c18b86c0d51
SSDEEP 3:LstlNllklkXlhRll:LsX3lPhDl
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\GraphiteDawnCache\index
Size 256KB
SHA256 eee527fa53ec1834760a5fbb9954a2067f3acd8f49ceea375db095882891d3e0
MD5 ec3ea31ae5de5b4e10343772f6f30900
SHA1 823a85e0765fca348664c6954766238a7861789c
SHA512 549b8e625a0ccd8a9f3543f27836be626786ffc1b94b5388c582a8d81ec5ff866657f491ec8958e36c3cb6219f0068aa27fe44ec5acaed15829c702971201068
SSDEEP 3:LstlNllklkXl9Ytll:LsX3lP+Xl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\Local State
Size 1KB
SHA256 b1f6f1ee5722154ac77fa4e8386a30feb67bf5c03836e5bf9e09689234b87559
MD5 3bbbea12664ebe51a810ac43209d5848
SHA1 0a65423234d016b81ca7a710a930da0c86bf90e9
SHA512 1d5029f07cb8a8082125bdac093e96507d2b348c744fdaf998b00b492c4883272263009503cd58d2d54174e89ee61208b7d72018fc97b652e2a116c01dbd492f
TLSH
T14711B57129685362B8D2469DC620D6A72F2852BBC191AC4CAFCE1A580B763EC3707C38
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pav3s2zx.dcq\ShaderCache\index
Size 256KB
SHA256 adaab8f1c896c9b3e4a567bba7696721dc1d73d2b3b472578dbe7c7d5785fcd3
MD5 109e9dff3ea5ddab15417038787b8ecc
SHA1 9c77fa7d3764c00537942e609e62cfb23420df33
SHA512 02ab64aabdf710063515277a826cb9e5f65fb4c7ae1781c854c8c6ec08c7ee26caeac2eae73fb8502df27435edc3ed63b0664561b1b67d73801e67f141db1a02
SSDEEP 3:LstlNllklkXl5XoQull:LsX3lPbql
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv\Crashpad\settings.dat
Size 280B
SHA256 7da3669e44aca9f01cce84959c7ee85dc9dfe31e9dcdc041ffbad3dfe5500afb
MD5 800f5a9e625527d15148625c389420f9
SHA1 b0417cad5639c11acdf6175c289333491c08ad6a
SHA512 36c2d70419e2652c62fd44d4371f01455aff689b69423fbaba9e09fa146745f72de24d29aae3dbfd2feb2c378e172a1b59b79ae38dcc39c25d1f76866b3bda48
TLSH
T12CD02451F3144075C10500335513D7074C31C530C071430011003D054F404103077044
MD5 SHA1 SHA512 TLSH

Submit Download

a854b742-fe8f-47c0-9e20-5921249ed95d.tmp

Path C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a854b742-fe8f-47c0-9e20-5921249ed95d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv\Local State
Size 4KB
SHA256 79f6f3f2893e9bae8efeb5878b99ca02eb3aef60dbc35724ca94775e96daa594
MD5 68a29e51aeaf1cb82194508ac321d748
SHA1 413491dbd6de9850ab5d4af4ce58efd92f41212f
SHA512 df46313835401ffb66ac0b7a54955c57c04fd8faa41a9413afba345fb664cc9446f7813ccb05d8181b30c5fd1448c74ddd3f2f1f1009cdae35d042720687c6b8
SSDEEP 96:cqGNkPQsFffL7iktJs58Frh/cInURoDotoviA4DztBnqvMocu0eUnqC0q4a:HGNPG5ooDUwiVHocuqnh
TLSH
T1FEA194766434ACBB9BF29E45B8863703AFF86137D5943F94DAD8161C05DB6981342833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv\Local State
Size 3KB
SHA256 9de180166ff07b012d618d47af062c2ae60e9905d3442bb0d7070eb20bfeab49
MD5 6868690ab3dd4834cf3d0612903af854
SHA1 6373642a3a897d5306d2a7a934cfab6616c5d623
SHA512 f5aca0cf88c6b673d914b6d15b6cc23434d36585a3cb780a0c0dd77c467cb0201ec2ef319dc10697d9c0b4a68f106388466d8d3c1a9eada01d3c77ec0beab3ea
TLSH
T1AA81937264347DF797F19E85B98A3A139FB87167D5A03E80EAD8131805EF55C2302837
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59ca5b.TMP

Path C:\Users\Admin\AppData\Local\Temp\w2so0n2p.ynv\Local State~RFe59ca5b.TMP
Size 1KB
SHA256 153ce6b137a3a9b3996082060fa43113ad22ad4a2f91923b3861544ca23dcee0
MD5 f9f072f3e8ab0ae3dd0742a1a833da6e
SHA1 2940816606bd64ee83dda40c55ad23cdd8a004c9
SHA512 1698498baec1b1e76d65518ce5bd6256c5a052bba265f14acf641c5f02563584d1a68417c44b7a39f4161c37eb9b060b992eed1ac013bb40716c8164a8430dc7
TLSH
T11B31BAB1A4752D77A5D15656E18977536F78B172C1D06D8861DC130906EB58C230BC37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/572-26-0x0000029842F10000-0x0000029842F20000-memory.dmp

Download

memory/616-0-0x0000024A1B2B0000-0x0000024A1B3A9000-memory.dmp

Download

memory/616-15-0x0000024A35CF0000-0x0000024A35EB2000-memory.dmp

Download

memory/616-6-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-4-0x0000024A35A20000-0x0000024A35B18000-memory.dmp

Download

memory/616-8-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-28-0x0000024A36380000-0x0000024A363D0000-memory.dmp

Download

memory/616-1-0x00007FFC1245F000-0x00007FFC12460000-memory.dmp

Download

memory/616-439-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-24-0x00007FF703710000-0x00007FF703816000-memory.dmp

Download

memory/616-23-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-22-0x0000024A357B0000-0x0000024A357C2000-memory.dmp

Download

memory/616-20-0x0000024A36DB0000-0x0000024A36FF4000-memory.dmp

Download

memory/616-19-0x0000024A360C0000-0x0000024A36306000-memory.dmp

Download

memory/616-18-0x0000024A363F0000-0x0000024A36918000-memory.dmp

Download

memory/616-17-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-16-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-2-0x0000024A35920000-0x0000024A35A18000-memory.dmp

Download

memory/616-14-0x0000024A1CE40000-0x0000024A1CEB6000-memory.dmp

Download

memory/616-5-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-7-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-11-0x0000024A1CD30000-0x0000024A1CD31000-memory.dmp

Download

memory/616-13-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-12-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-240-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-10-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-374-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-3-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-9-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-424-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/616-422-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/832-421-0x0000024CF7E50000-0x0000024CF7F02000-memory.dmp

Download

memory/832-423-0x0000024CF7F10000-0x0000024CF7F1A000-memory.dmp

Download

memory/832-420-0x0000024CF7E30000-0x0000024CF7E4E000-memory.dmp

Download

memory/832-397-0x0000024CF7D70000-0x0000024CF7D92000-memory.dmp

Download

memory/2544-437-0x00000188536A0000-0x00000188536AA000-memory.dmp

Download

memory/4328-446-0x000002B8F0A30000-0x000002B8F0AE2000-memory.dmp

Download

memory/4328-449-0x000002B8F07F0000-0x000002B8F080E000-memory.dmp

Download

memory/5768-27-0x00000254EEFB0000-0x00000254EEFCE000-memory.dmp

Download

memory/5768-25-0x00000254EEF40000-0x00000254EEF50000-memory.dmp

Download