Malware Analysis Report

2025-06-16 05:44

Sample ID 240301-zqgrqsdb41
Target AsyncClient.exe
SHA256 5b23cda7e61a7e54331995b5eab48efd59ff50455881027ea8bd5cd70a6833a0
Tags
rat adsf asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5b23cda7e61a7e54331995b5eab48efd59ff50455881027ea8bd5cd70a6833a0

Threat Level: Known bad

The file AsyncClient.exe was found to be: Known bad.

Malicious Activity Summary

rat adsf asyncrat

AsyncRat

Asyncrat family

Async RAT payload

Async RAT payload

Checks computer location settings

Executes dropped EXE

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-01 20:55

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-01 20:55

Reported

2024-03-01 20:58

Platform

win10-20240221-en

Max time kernel

148s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\test.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\test.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 192 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 192 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 192 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 192 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 192 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 192 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4908 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4908 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4912 wrote to memory of 3548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4912 wrote to memory of 3548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4912 wrote to memory of 3548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4912 wrote to memory of 244 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\test.exe
PID 4912 wrote to memory of 244 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\test.exe
PID 4912 wrote to memory of 244 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\test.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe

"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFED2.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\test.exe

"C:\Users\Admin\AppData\Roaming\test.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 FearME-55506.portmap.host udp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp

Files

memory/192-0-0x00000000007E0000-0x00000000007F2000-memory.dmp

memory/192-1-0x0000000073E70000-0x000000007455E000-memory.dmp

memory/192-2-0x00000000012B0000-0x00000000012C0000-memory.dmp

memory/192-3-0x0000000005190000-0x000000000522C000-memory.dmp

memory/192-8-0x0000000073E70000-0x000000007455E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpFED2.tmp.bat

MD5 c910cec0bd28b6fa70c0d6e4440b0512
SHA1 62b42e7925e925a003c15af6537fd67d786644c2
SHA256 67b0dc44c8eaef07107eac1b919eb976ac644f894bd30cf6bd83e4009c584a70
SHA512 83d68a61dbc906665280cde3f33d84135978bee5ccf4e48bbb10cb88de6348c3a3f6dbbc45c491024c792ccab4c4985bf464b80dc16e563a4813db442b9938c0

C:\Users\Admin\AppData\Roaming\test.exe

MD5 1318c166e2823474696400cb49c69019
SHA1 41cac1850c0e996752475baa19716b0dfcf88351
SHA256 5b23cda7e61a7e54331995b5eab48efd59ff50455881027ea8bd5cd70a6833a0
SHA512 1fad54e3f6b8c1ac376456aa4f3be361898e9126955425f75181a7f9d2e28e09597a60a7ccd8588af47ebad9b3672ab53e09321b82bc51df4536442c96bc157f

memory/244-13-0x0000000073DD0000-0x00000000744BE000-memory.dmp

memory/244-14-0x0000000005850000-0x0000000005860000-memory.dmp

memory/244-15-0x0000000073DD0000-0x00000000744BE000-memory.dmp

memory/244-16-0x0000000005850000-0x0000000005860000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-01 20:55

Reported

2024-03-01 20:58

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\test.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\test.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1904 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 4056 wrote to memory of 628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4056 wrote to memory of 628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4056 wrote to memory of 628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 452 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 452 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 452 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 452 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\test.exe
PID 452 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\test.exe
PID 452 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\test.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe

"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp335F.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\test.exe

"C:\Users\Admin\AppData\Roaming\test.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 5.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 FearME-55506.portmap.host udp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
IE 172.253.116.95:443 chromewebstore.googleapis.com tcp
IE 172.253.116.95:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 95.116.253.172.in-addr.arpa udp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 29.179.17.96.in-addr.arpa udp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
US 8.8.8.8:53 200.79.70.13.in-addr.arpa udp
DE 193.161.193.99:55506 tcp

Files

memory/1904-0-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/1904-1-0x0000000000920000-0x0000000000932000-memory.dmp

memory/1904-2-0x0000000005370000-0x0000000005380000-memory.dmp

memory/1904-3-0x0000000005420000-0x00000000054BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp335F.tmp.bat

MD5 5fa55660c88c837db90adf9958fe28ce
SHA1 f7e248a53f0f650a6f8e27427fba11e1c7010fa0
SHA256 63a1a9a23023aa29057fc517ef1532b58f1824183765ee744800773a16c6fd70
SHA512 7ba5d44d67cb74fb47cd3fc18d0a05530d73464f9fd3793569dd1d892f0ad9e65a8fedd48d8c2bb3974cd7311e2c720e92889a7bef9538a88d2f83c376be40fd

memory/1904-9-0x0000000074E30000-0x00000000755E0000-memory.dmp

C:\Users\Admin\AppData\Roaming\test.exe

MD5 1318c166e2823474696400cb49c69019
SHA1 41cac1850c0e996752475baa19716b0dfcf88351
SHA256 5b23cda7e61a7e54331995b5eab48efd59ff50455881027ea8bd5cd70a6833a0
SHA512 1fad54e3f6b8c1ac376456aa4f3be361898e9126955425f75181a7f9d2e28e09597a60a7ccd8588af47ebad9b3672ab53e09321b82bc51df4536442c96bc157f

memory/764-13-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/764-14-0x00000000053C0000-0x00000000053D0000-memory.dmp

memory/764-15-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/764-16-0x00000000053C0000-0x00000000053D0000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-01 20:55

Reported

2024-03-01 20:57

Platform

win11-20240221-en

Max time kernel

146s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\test.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\test.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4000 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 3580 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3580 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3580 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 484 wrote to memory of 3124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 484 wrote to memory of 3124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 484 wrote to memory of 3124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3580 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\test.exe
PID 3580 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\test.exe
PID 3580 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\test.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe

"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6699.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"'

C:\Users\Admin\AppData\Roaming\test.exe

"C:\Users\Admin\AppData\Roaming\test.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 FearME-55506.portmap.host udp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:55506 FearME-55506.portmap.host tcp
DE 193.161.193.99:5508 FearME-55506.portmap.host tcp

Files

memory/4000-0-0x0000000000250000-0x0000000000262000-memory.dmp

memory/4000-1-0x0000000074C70000-0x0000000075421000-memory.dmp

memory/4000-2-0x0000000004D10000-0x0000000004D20000-memory.dmp

memory/4000-3-0x0000000004D20000-0x0000000004DBC000-memory.dmp

memory/4000-8-0x0000000074C70000-0x0000000075421000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp6699.tmp.bat

MD5 373535f30badea65c0c6b4115711f4da
SHA1 919e3f7e01c705d0cf812c49e0920a539517bffe
SHA256 45b05de917e3250057cb33b00649b54d55b1b67cf83738517f4dd9445a74635a
SHA512 feabb1b5cbe7e9408752f86693ef3a5e122d686df4f43f0b1b8a028c1744b5df1021529771530cbe68102832c5dc104a2ddc08e59fbd31b84f3081e320bbfb18

C:\Users\Admin\AppData\Roaming\test.exe

MD5 1318c166e2823474696400cb49c69019
SHA1 41cac1850c0e996752475baa19716b0dfcf88351
SHA256 5b23cda7e61a7e54331995b5eab48efd59ff50455881027ea8bd5cd70a6833a0
SHA512 1fad54e3f6b8c1ac376456aa4f3be361898e9126955425f75181a7f9d2e28e09597a60a7ccd8588af47ebad9b3672ab53e09321b82bc51df4536442c96bc157f

memory/1584-13-0x0000000074BC0000-0x0000000075371000-memory.dmp

memory/1584-14-0x0000000005730000-0x0000000005740000-memory.dmp

memory/1584-15-0x0000000074BC0000-0x0000000075371000-memory.dmp

memory/1584-16-0x0000000005730000-0x0000000005740000-memory.dmp