asyncrat | 069e0cb4a7fcf627459696e4257f4b471eee3a863a477e4ce0bb74ac9830e671

Analysis

max time kernel
144s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2023 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Anacrhy Panel.exe
Size

48.7MB
MD5

33ce5b0d118abf329444aef57dbe7eb6
SHA1

7a6ef6db2411546257b477c8e86d7cf1958a090e
SHA256

069e0cb4a7fcf627459696e4257f4b471eee3a863a477e4ce0bb74ac9830e671
SHA512

1ddc7bc7e107f99f1298e556b837b1024532d08cb312ec7284a3cd67f43c2823a73d00a92ce67711818fc9117a8c84953a927170f8d9d8a89e448334608bf924
SSDEEP

786432:9G+SChsSUN7Wrwx3VyOdSgffEFZBTK1jCeb39z/MkJk+cP3l/hnp/2yahNNkuPtH:9SRSJrk38CVEWjNb39gki/R/2JhlFCwx

Score

10^/10

asyncrat dcrat evasion infostealer rat trojan

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\portruntime\HhUvyFrf266T.vbe	disable_win_def

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

WScript.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	WScript.exe

Async RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\crack.exe	asyncrat
C:\Users\Admin\AppData\Local\Temp\crack.exe	asyncrat
C:\Users\Admin\AppData\Local\Temp\crack.exe	asyncrat
behavioral2/memory/2052-177-0x0000000000CA0000-0x000000000433E000-memory.dmp	asyncrat
behavioral2/memory/1120-310-0x000000001BEE0000-0x000000001BEF0000-memory.dmp	asyncrat

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\load_dile.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\load_dile.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\load_dile.exe	dcrat
C:\Users\Admin\AppData\Roaming\portruntime\winsession.exe	dcrat
C:\Users\Admin\AppData\Roaming\portruntime\winsession.exe	dcrat
behavioral2/memory/1120-308-0x0000000000F50000-0x0000000001284000-memory.dmp	dcrat

Downloads MZ/PE file

.NET Reactor proctector 4 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\crack.exe	net_reactor
C:\Users\Admin\AppData\Local\Temp\crack.exe	net_reactor
C:\Users\Admin\AppData\Local\Temp\crack.exe	net_reactor
behavioral2/memory/2052-177-0x0000000000CA0000-0x000000000433E000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

load_dile.exeWScript.exeWScript.exeWScript.exeAnacrhy Panel.exeload.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	load_dile.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	Anacrhy Panel.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	load.exe

Executes dropped EXE 4 IoCs

Processes:

load.execrack.exeload_dile.exewinsession.exe

pid process

3968 load.exe
2052 crack.exe
1980 load_dile.exe
1120 winsession.exe
Loads dropped DLL 1 IoCs

Processes:

crack.exe

pid process

2052 crack.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

load_dile.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings load_dile.exe

pid	process
3968	load.exe
2052	crack.exe
1980	load_dile.exe
1120	winsession.exe

pid	process
2052	crack.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	load_dile.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execrack.exe

pid	process
2776	powershell.exe
2776	powershell.exe
2732	powershell.exe
2732	powershell.exe
2372	powershell.exe
2372	powershell.exe
3304	powershell.exe
3304	powershell.exe
852	powershell.exe
852	powershell.exe
960	powershell.exe
960	powershell.exe
3976	powershell.exe
3976	powershell.exe
4576	powershell.exe
4576	powershell.exe
3240	powershell.exe
2296	powershell.exe
2296	powershell.exe
3240	powershell.exe
2380	powershell.exe
2380	powershell.exe
2732	powershell.exe
3976	powershell.exe
2776	powershell.exe
2776	powershell.exe
2372	powershell.exe
960	powershell.exe
852	powershell.exe
3304	powershell.exe
4576	powershell.exe
2380	powershell.exe
2296	powershell.exe
3240	powershell.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe
2052	crack.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

load.execrack.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinsession.exe

description	pid	process
Token: SeDebugPrivilege	3968	load.exe
Token: SeDebugPrivilege	2052	crack.exe
Token: SeDebugPrivilege	960	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	852	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	1120	winsession.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

crack.exe

pid process

2052 crack.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

crack.exe

pid process

2052 crack.exe

pid	process
2052	crack.exe

pid	process
2052	crack.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

Anacrhy Panel.exeload.exeload_dile.exeWScript.exeWScript.exeWScript.execmd.exe

description	pid	process	target process
PID 3828 wrote to memory of 3968	3828	Anacrhy Panel.exe	load.exe
PID 3828 wrote to memory of 3968	3828	Anacrhy Panel.exe	load.exe
PID 3828 wrote to memory of 2052	3828	Anacrhy Panel.exe	crack.exe
PID 3828 wrote to memory of 2052	3828	Anacrhy Panel.exe	crack.exe
PID 3968 wrote to memory of 1980	3968	load.exe	load_dile.exe
PID 3968 wrote to memory of 1980	3968	load.exe	load_dile.exe
PID 3968 wrote to memory of 1980	3968	load.exe	load_dile.exe
PID 1980 wrote to memory of 4300	1980	load_dile.exe	WScript.exe
PID 1980 wrote to memory of 4300	1980	load_dile.exe	WScript.exe
PID 1980 wrote to memory of 4300	1980	load_dile.exe	WScript.exe
PID 1980 wrote to memory of 3076	1980	load_dile.exe	WScript.exe
PID 1980 wrote to memory of 3076	1980	load_dile.exe	WScript.exe
PID 1980 wrote to memory of 3076	1980	load_dile.exe	WScript.exe
PID 3076 wrote to memory of 3484	3076	WScript.exe	WScript.exe
PID 3076 wrote to memory of 3484	3076	WScript.exe	WScript.exe
PID 3076 wrote to memory of 3484	3076	WScript.exe	WScript.exe
PID 3484 wrote to memory of 2776	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2776	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2776	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 3976	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 3976	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 3976	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2732	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2732	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2732	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 960	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 960	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 960	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2372	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2372	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2372	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 3304	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 3304	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 3304	3484	WScript.exe	powershell.exe
PID 4300 wrote to memory of 5088	4300	WScript.exe	cmd.exe
PID 4300 wrote to memory of 5088	4300	WScript.exe	cmd.exe
PID 4300 wrote to memory of 5088	4300	WScript.exe	cmd.exe
PID 3484 wrote to memory of 852	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 852	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 852	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 4576	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 4576	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 4576	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2296	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2296	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2296	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 3240	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 3240	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 3240	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2380	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2380	3484	WScript.exe	powershell.exe
PID 3484 wrote to memory of 2380	3484	WScript.exe	powershell.exe
PID 5088 wrote to memory of 1120	5088	cmd.exe	winsession.exe
PID 5088 wrote to memory of 1120	5088	cmd.exe	winsession.exe

C:\Users\Admin\AppData\Local\Temp\Anacrhy Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Anacrhy Panel.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3828

C:\Users\Admin\AppData\Local\Temp\load.exe
"C:\Users\Admin\AppData\Local\Temp\load.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968

C:\Users\Admin\AppData\Local\Temp\load_dile.exe
"C:\Users\Admin\AppData\Local\Temp\load_dile.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\portruntime\hSfGopwuyDtB4lb.vbe"
4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4300

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\portruntime\4aoMg0Ud25u41z9hca1.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:5088

C:\Users\Admin\AppData\Roaming\portruntime\winsession.exe
"C:\Users\Admin\AppData\Roaming\portruntime\winsession.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\portruntime\HhUvyFrf266T.vbe"
4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3076

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\SysWOW64\WScript.exe" "C:\Users\Admin\AppData\Roaming\portruntime\HhUvyFrf266T.vbe" /elevate
5⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3484

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBehaviorMonitoring $true
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Users\Admin\AppData\Local\Temp\crack.exe
"C:\Users\Admin\AppData\Local\Temp\crack.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2052

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4240

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
5d8d406150c3fffc6ea72d7f649dc93b

SHA1
ad183b585b83a20a521d6e4b180151e6e8cbdce6

SHA256
73a437e2aa29d4452447b235d055adb95b386c24b327332387519a44f7088055

SHA512
07eb84a4ec092756b49fe3bba55fdf2f093f747c8a87645012d55e48b2f3e9bcd2bce9be688ac1ec85a46c08aaedb798d1b1d64a17b4791c0fd5b23f964c8fdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
edac9cdf82ba7a83975e6ca48fff0384

SHA1
163d11196df48e54ef856353365687d1495fb749

SHA256
7bae141480355eda3f8fc18a278f3b64892faec221386d0c80b17705a3481d01

SHA512
27eee66a0fd770231f904c03654cf60b72f5f09d52451b071af98791ac0fc3e258e7fac125fe8e8873e6c20537d2ff3588400e157e5c71f130b92f43f38b53b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
edac9cdf82ba7a83975e6ca48fff0384

SHA1
163d11196df48e54ef856353365687d1495fb749

SHA256
7bae141480355eda3f8fc18a278f3b64892faec221386d0c80b17705a3481d01

SHA512
27eee66a0fd770231f904c03654cf60b72f5f09d52451b071af98791ac0fc3e258e7fac125fe8e8873e6c20537d2ff3588400e157e5c71f130b92f43f38b53b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
a83f3c6417518faeb023eae5cfdba494

SHA1
3aeeb56ec4e8ec4fd5bc133df6658acf5acd3f36

SHA256
0e355bd3d74d7eb614c7fd0689994a6ceaf0efdfd80f39f090adc6a125a3ba9c

SHA512
9001961a83d993361b21bd3186d6aa49c81f539982f2c51611938ea7bd316ef50b65a9b0db3c986a3a83f274dd8d9629e6c32e61bac23dfb2dadcc1b408b1d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
8277bde2d902cb46ba22e33ea33c7fa7

SHA1
d5f02bd8e7bd3a6b2063d6b86373bbd06a4ae72b

SHA256
c8cb3277fd5d0185d27ea0487df427f7e2a412cf253df44dbdbf15a74afed8ac

SHA512
c8fd62fa32868eb93344081b095ec81c7c5f6bbe1b71d6773bfd9efb4a99dee6ac88e18d54dd6be1229ff2efdf8802ee928125fd0e156bb3024139f6d52ad84b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
42407f1c95691f267d299ed27fe969ce

SHA1
1d97f1e66b8ba070f1970a907f38a1ad9c362a9f

SHA256
a2e3abf3933064efd88a28541e164831b5f3fbae74bbce8e46856714d586c717

SHA512
2430c0fd465664a7df7caed1e520069ea8ae48410c0ac017904878d32f1a59d9611008afca82dc8d57a19141e54c91ad9a63257f902112b25d99f614a2590c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
42407f1c95691f267d299ed27fe969ce

SHA1
1d97f1e66b8ba070f1970a907f38a1ad9c362a9f

SHA256
a2e3abf3933064efd88a28541e164831b5f3fbae74bbce8e46856714d586c717

SHA512
2430c0fd465664a7df7caed1e520069ea8ae48410c0ac017904878d32f1a59d9611008afca82dc8d57a19141e54c91ad9a63257f902112b25d99f614a2590c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
42407f1c95691f267d299ed27fe969ce

SHA1
1d97f1e66b8ba070f1970a907f38a1ad9c362a9f

SHA256
a2e3abf3933064efd88a28541e164831b5f3fbae74bbce8e46856714d586c717

SHA512
2430c0fd465664a7df7caed1e520069ea8ae48410c0ac017904878d32f1a59d9611008afca82dc8d57a19141e54c91ad9a63257f902112b25d99f614a2590c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
42407f1c95691f267d299ed27fe969ce

SHA1
1d97f1e66b8ba070f1970a907f38a1ad9c362a9f

SHA256
a2e3abf3933064efd88a28541e164831b5f3fbae74bbce8e46856714d586c717

SHA512
2430c0fd465664a7df7caed1e520069ea8ae48410c0ac017904878d32f1a59d9611008afca82dc8d57a19141e54c91ad9a63257f902112b25d99f614a2590c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
42407f1c95691f267d299ed27fe969ce

SHA1
1d97f1e66b8ba070f1970a907f38a1ad9c362a9f

SHA256
a2e3abf3933064efd88a28541e164831b5f3fbae74bbce8e46856714d586c717

SHA512
2430c0fd465664a7df7caed1e520069ea8ae48410c0ac017904878d32f1a59d9611008afca82dc8d57a19141e54c91ad9a63257f902112b25d99f614a2590c71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\C5730A4C0FDD612A5678E51A536CE09E\64\sqlite.interop.dll
Filesize
1.7MB

MD5
56a504a34d2cfbfc7eaa2b68e34af8ad

SHA1
426b48b0f3b691e3bb29f465aed9b936f29fc8cc

SHA256
9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961

SHA512
170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_552asmqk.mnd.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\crack.exe
Filesize
54.6MB

MD5
94bac1a0cc0dbac256f0d3b4c90648c2

SHA1
4abcb8a31881e88322f6a37cbb24a14a80c6eef2

SHA256
50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94

SHA512
30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\crack.exe
Filesize
54.6MB

MD5
94bac1a0cc0dbac256f0d3b4c90648c2

SHA1
4abcb8a31881e88322f6a37cbb24a14a80c6eef2

SHA256
50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94

SHA512
30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\crack.exe
Filesize
54.6MB

MD5
94bac1a0cc0dbac256f0d3b4c90648c2

SHA1
4abcb8a31881e88322f6a37cbb24a14a80c6eef2

SHA256
50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94

SHA512
30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\load.exe
Filesize
62KB

MD5
4442cab7c11b2395fcaa9a6571f4a5f0

SHA1
d50d0bcf68b79f48cfdc0dab8ee2fdccb8d22b98

SHA256
54ad1bedaebad672fa9f573bff1a03b6da29de46f04cc31334f51317cc72702e

SHA512
ffc5e855ed8ccde742afab96238859f1c88c8a8b711f42a97c9606f5adf1d15794914bca9add80b8a5808b1d4b42df561f7c8eb9c417f802bee0296789345f19

Download Submit
C:\Users\Admin\AppData\Local\Temp\load.exe
Filesize
62KB

MD5
4442cab7c11b2395fcaa9a6571f4a5f0

SHA1
d50d0bcf68b79f48cfdc0dab8ee2fdccb8d22b98

SHA256
54ad1bedaebad672fa9f573bff1a03b6da29de46f04cc31334f51317cc72702e

SHA512
ffc5e855ed8ccde742afab96238859f1c88c8a8b711f42a97c9606f5adf1d15794914bca9add80b8a5808b1d4b42df561f7c8eb9c417f802bee0296789345f19

Download Submit
C:\Users\Admin\AppData\Local\Temp\load.exe
Filesize
62KB

MD5
4442cab7c11b2395fcaa9a6571f4a5f0

SHA1
d50d0bcf68b79f48cfdc0dab8ee2fdccb8d22b98

SHA256
54ad1bedaebad672fa9f573bff1a03b6da29de46f04cc31334f51317cc72702e

SHA512
ffc5e855ed8ccde742afab96238859f1c88c8a8b711f42a97c9606f5adf1d15794914bca9add80b8a5808b1d4b42df561f7c8eb9c417f802bee0296789345f19

Download Submit
C:\Users\Admin\AppData\Local\Temp\load_dile.exe
Filesize
3.5MB

MD5
cf89c00e46ac76d5fe3785d5934abb06

SHA1
2e59d9cccb05c51f4f1fcd141e4af33de6eb1c80

SHA256
1b9c1b227a2f27382827133dde3a28b8af5268f72b6ae3dc23ba0abcbe4c8409

SHA512
ea27561736979c5c1c62934e4c4e904e0ae4d84a304cafe4775b02e1fff0f22d5340acfb6b3a77f043a2162b7d7ce4dd0b6609dd03f18cba61dd6812f18bab74

Download Submit
C:\Users\Admin\AppData\Local\Temp\load_dile.exe
Filesize
3.5MB

MD5
cf89c00e46ac76d5fe3785d5934abb06

SHA1
2e59d9cccb05c51f4f1fcd141e4af33de6eb1c80

SHA256
1b9c1b227a2f27382827133dde3a28b8af5268f72b6ae3dc23ba0abcbe4c8409

SHA512
ea27561736979c5c1c62934e4c4e904e0ae4d84a304cafe4775b02e1fff0f22d5340acfb6b3a77f043a2162b7d7ce4dd0b6609dd03f18cba61dd6812f18bab74

Download Submit
C:\Users\Admin\AppData\Local\Temp\load_dile.exe
Filesize
3.5MB

MD5
cf89c00e46ac76d5fe3785d5934abb06

SHA1
2e59d9cccb05c51f4f1fcd141e4af33de6eb1c80

SHA256
1b9c1b227a2f27382827133dde3a28b8af5268f72b6ae3dc23ba0abcbe4c8409

SHA512
ea27561736979c5c1c62934e4c4e904e0ae4d84a304cafe4775b02e1fff0f22d5340acfb6b3a77f043a2162b7d7ce4dd0b6609dd03f18cba61dd6812f18bab74

Download Submit
C:\Users\Admin\AppData\Roaming\portruntime\4aoMg0Ud25u41z9hca1.bat
Filesize
38B

MD5
598f9b4413a605659864abc97e0a72bb

SHA1
4891a308954fde5f94ec0935938d371cdc6e6408

SHA256
fd3c08b5172170ed2097daf6dcfe46588aa989cea1471081911cac35b261f0e4

SHA512
cf35baa500f10fb2e6da1fd6f20d3d53ebc370b0ffcda7755b0a2eaa3643dc6d01bfaf461962a493949b7c4f18f95311a15312fc59b0cc241047d4cfc9dc6188

Download Submit
C:\Users\Admin\AppData\Roaming\portruntime\HhUvyFrf266T.vbe
Filesize
1KB

MD5
3183ab3e54079f5094f0438ad5d460f6

SHA1
850eacdf078b851378fee9b83a895a247f3ff1ed

SHA256
16da599511714cce9fd5888b1cc06bdb44857fc9147f9a2b5eed422d9ae40415

SHA512
31e996ae9eaf26a7292a6c3c0d7a4284228dec13d082a82f0b5f8825cd265a249e266b5a99c755f41dfd370ce8a179ad29780311c1f49f89dc80f5e4a99ce31e

Download Submit
C:\Users\Admin\AppData\Roaming\portruntime\hSfGopwuyDtB4lb.vbe
Filesize
214B

MD5
2358a01362079a90aac9605e41461d6f

SHA1
2e94f300d93724e1e69a226e58c7d17ffc89a79a

SHA256
aaf09f9697830fb827905fc2f315104c7b2a28a8b4f76e67c833189638a27f9f

SHA512
aac73c379da5fb09d978d49b882ed2121879892a675dba74a4ce58a09505322663ee0240836448650c0a4128b4e088f112f4a2f915ad5a78dab56d09ad05db04

Download Submit
C:\Users\Admin\AppData\Roaming\portruntime\winsession.exe
Filesize
3.2MB

MD5
ac43728fc989a1f67b8e17db79920f09

SHA1
53386be2a9899cacf11b98c079c16c2861462ff6

SHA256
0cd2ee19652cba1ad1e2f8dc952b4925a6e6ba1038fe0f249322d19db4fa750b

SHA512
6ac841e976655124889057341fcfde7cdec90277abfe3ab55dbef3261cda5d5d07ae4b1ac4e08438ada560cf9bae2864cd086dc49a78ae4a2f47ff62daebc326

Download Submit
C:\Users\Admin\AppData\Roaming\portruntime\winsession.exe
Filesize
3.2MB

MD5
ac43728fc989a1f67b8e17db79920f09

SHA1
53386be2a9899cacf11b98c079c16c2861462ff6

SHA256
0cd2ee19652cba1ad1e2f8dc952b4925a6e6ba1038fe0f249322d19db4fa750b

SHA512
6ac841e976655124889057341fcfde7cdec90277abfe3ab55dbef3261cda5d5d07ae4b1ac4e08438ada560cf9bae2864cd086dc49a78ae4a2f47ff62daebc326

Download Submit
memory/852-439-0x000000007F000000-0x000000007F010000-memory.dmp

Filesize
64KB

Download
memory/852-378-0x0000000074430000-0x000000007447C000-memory.dmp

Filesize
304KB

Download
memory/852-260-0x0000000002850000-0x0000000002860000-memory.dmp

Filesize
64KB

Download
memory/960-192-0x0000000005510000-0x0000000005532000-memory.dmp

Filesize
136KB

Download
memory/960-316-0x0000000004870000-0x0000000004880000-memory.dmp

Filesize
64KB

Download
memory/960-186-0x0000000004870000-0x0000000004880000-memory.dmp

Filesize
64KB

Download
memory/960-445-0x0000000004870000-0x0000000004880000-memory.dmp

Filesize
64KB

Download
memory/960-179-0x0000000002390000-0x00000000023C6000-memory.dmp

Filesize
216KB

Download
memory/960-370-0x0000000074430000-0x000000007447C000-memory.dmp

Filesize
304KB

Download
memory/960-438-0x000000007F0C0000-0x000000007F0D0000-memory.dmp

Filesize
64KB

Download
memory/960-181-0x0000000004870000-0x0000000004880000-memory.dmp

Filesize
64KB

Download
memory/1120-310-0x000000001BEE0000-0x000000001BEF0000-memory.dmp

Filesize
64KB

Download
memory/1120-308-0x0000000000F50000-0x0000000001284000-memory.dmp

Filesize
3.2MB

Download
memory/2052-261-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download
memory/2052-307-0x00000000065C0000-0x00000000065D2000-memory.dmp

Filesize
72KB

Download
memory/2052-251-0x000000001F130000-0x000000001F140000-memory.dmp

Filesize
64KB

Download
memory/2052-311-0x000000001F130000-0x000000001F140000-memory.dmp

Filesize
64KB

Download
memory/2052-312-0x000000001F130000-0x000000001F140000-memory.dmp

Filesize
64KB

Download
memory/2052-313-0x000000001F130000-0x000000001F140000-memory.dmp

Filesize
64KB

Download
memory/2052-177-0x0000000000CA0000-0x000000000433E000-memory.dmp

Filesize
54.6MB

Download
memory/2296-442-0x000000007F400000-0x000000007F410000-memory.dmp

Filesize
64KB

Download
memory/2296-357-0x0000000074430000-0x000000007447C000-memory.dmp

Filesize
304KB

Download
memory/2296-190-0x00000000047D0000-0x00000000047E0000-memory.dmp

Filesize
64KB

Download
memory/2372-187-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/2372-188-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/2372-446-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/2372-427-0x000000007F5A0000-0x000000007F5B0000-memory.dmp

Filesize
64KB

Download
memory/2372-336-0x0000000006B60000-0x0000000006B7E000-memory.dmp

Filesize
120KB

Download
memory/2372-322-0x0000000074430000-0x000000007447C000-memory.dmp

Filesize
304KB

Download
memory/2380-407-0x000000007EE20000-0x000000007EE30000-memory.dmp

Filesize
64KB

Download
memory/2380-323-0x0000000074430000-0x000000007447C000-memory.dmp

Filesize
304KB

Download
memory/2380-191-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2380-443-0x00000000079E0000-0x00000000079FA000-memory.dmp

Filesize
104KB

Download
memory/2380-440-0x0000000008020000-0x000000000869A000-memory.dmp

Filesize
6.5MB

Download
memory/2380-314-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2732-309-0x0000000006130000-0x000000000614E000-memory.dmp

Filesize
120KB

Download
memory/2732-441-0x000000007FBD0000-0x000000007FBE0000-memory.dmp

Filesize
64KB

Download
memory/2732-180-0x00000000053A0000-0x00000000059C8000-memory.dmp

Filesize
6.2MB

Download
memory/2732-182-0x00000000028C0000-0x00000000028D0000-memory.dmp

Filesize
64KB

Download
memory/2732-184-0x00000000028C0000-0x00000000028D0000-memory.dmp

Filesize
64KB

Download
memory/2732-356-0x0000000074430000-0x000000007447C000-memory.dmp

Filesize
304KB

Download
memory/2732-317-0x00000000028C0000-0x00000000028D0000-memory.dmp

Filesize
64KB

Download
memory/2776-325-0x0000000074430000-0x000000007447C000-memory.dmp

Filesize
304KB

Download
memory/2776-315-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/3240-388-0x0000000074430000-0x000000007447C000-memory.dmp

Filesize
304KB

Download
memory/3240-318-0x0000000002860000-0x0000000002870000-memory.dmp

Filesize
64KB

Download
memory/3304-444-0x0000000006D10000-0x0000000006D1A000-memory.dmp

Filesize
40KB

Download
memory/3304-324-0x0000000074430000-0x000000007447C000-memory.dmp

Filesize
304KB

Download
memory/3304-319-0x0000000005440000-0x0000000005450000-memory.dmp

Filesize
64KB

Download
memory/3304-256-0x0000000005440000-0x0000000005450000-memory.dmp

Filesize
64KB

Download
memory/3304-437-0x000000007EEB0000-0x000000007EEC0000-memory.dmp

Filesize
64KB

Download
memory/3304-189-0x0000000005440000-0x0000000005450000-memory.dmp

Filesize
64KB

Download
memory/3968-155-0x000000001B020000-0x000000001B030000-memory.dmp

Filesize
64KB

Download
memory/3968-149-0x0000000000490000-0x00000000004A8000-memory.dmp

Filesize
96KB

Download
memory/3976-337-0x0000000002E00000-0x0000000002E10000-memory.dmp

Filesize
64KB

Download
memory/3976-193-0x0000000005FC0000-0x0000000006026000-memory.dmp

Filesize
408KB

Download
memory/3976-194-0x0000000006030000-0x0000000006096000-memory.dmp

Filesize
408KB

Download
memory/3976-185-0x0000000002E00000-0x0000000002E10000-memory.dmp

Filesize
64KB

Download
memory/3976-183-0x0000000002E00000-0x0000000002E10000-memory.dmp

Filesize
64KB

Download
memory/3976-417-0x0000000074430000-0x000000007447C000-memory.dmp

Filesize
304KB

Download
memory/4576-321-0x0000000006DC0000-0x0000000006DF2000-memory.dmp

Filesize
200KB

Download
memory/4576-377-0x000000007F4E0000-0x000000007F4F0000-memory.dmp

Filesize
64KB

Download
memory/4576-326-0x0000000074430000-0x000000007447C000-memory.dmp

Filesize
304KB

Download
memory/4576-263-0x0000000002690000-0x00000000026A0000-memory.dmp

Filesize
64KB

Download