asyncrat | bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73

Analysis

max time kernel
51s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Visual Protector.exe
Size 1.0MB
Sample240406-1frpmacd36
SHA256 bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73
MD5 2fd0387cb9fa37855f8a9c196c115131
SHA1 3a1b1f53e4a57a622a82ee6d149792fd7c212a13
SHA512 1fe92302bba86858e989203fc8826a4bd326226b7025d32be946f59a9035cc17d0734c50d724c560a288311ed1d4f07824c30e456988ab2e5b7432eb4d47a095
SSDEEP 12288:2fk2b3JKzOdEtjBA0zg1fA3UOaCl114p1xOAKSkjdrhV0DyqPod4/oADOUltRTrJ:q7LAzOd+jBhzkfhOaq11qIx5IrooVY4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat rat10 rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

RAT10

darkstorm275991.ddns.net:6606
darkstorm275991.ddns.net:7707
darkstorm275991.ddns.net:8808
mrreport.duckdns.org:6606
mrreport.duckdns.org:7707
mrreport.duckdns.org:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
Microsoft.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x00080000000231ea-16.dat	family_asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Visual Protector.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Microsoft.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VisualProtector.lnk	Visual Protector.exe

Executes dropped EXE 4 IoCs

pid	Process
4456	Visual Protector.exe
972	Microsoft.exe
4908	Visual Protector.exe
2484	Microsoft.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2564	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2092	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
548	msedge.exe
548	msedge.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
972	Microsoft.exe
3560	identity_helper.exe
3560	identity_helper.exe
2484	Microsoft.exe
2484	Microsoft.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	972	Microsoft.exe
Token: SeDebugPrivilege	2484	Microsoft.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2484	Microsoft.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 4456	4344	Visual Protector.exe	88
PID 4344 wrote to memory of 4456	4344	Visual Protector.exe	88
PID 4344 wrote to memory of 4456	4344	Visual Protector.exe	88
PID 4344 wrote to memory of 972	4344	Visual Protector.exe	118
PID 4344 wrote to memory of 972	4344	Visual Protector.exe	118
PID 4344 wrote to memory of 972	4344	Visual Protector.exe	118
PID 4344 wrote to memory of 548	4344	Visual Protector.exe	91
PID 4344 wrote to memory of 548	4344	Visual Protector.exe	91
PID 548 wrote to memory of 4924	548	msedge.exe	92
PID 548 wrote to memory of 4924	548	msedge.exe	92
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 4504	548	msedge.exe	93
PID 548 wrote to memory of 1836	548	msedge.exe	94
PID 548 wrote to memory of 1836	548	msedge.exe	94
PID 548 wrote to memory of 5116	548	msedge.exe	95
PID 548 wrote to memory of 5116	548	msedge.exe	95
PID 548 wrote to memory of 5116	548	msedge.exe	95
PID 548 wrote to memory of 5116	548	msedge.exe	95
PID 548 wrote to memory of 5116	548	msedge.exe	95
PID 548 wrote to memory of 5116	548	msedge.exe	95
PID 548 wrote to memory of 5116	548	msedge.exe	95
PID 548 wrote to memory of 5116	548	msedge.exe	95
PID 548 wrote to memory of 5116	548	msedge.exe	95
PID 548 wrote to memory of 5116	548	msedge.exe	95
PID 548 wrote to memory of 5116	548	msedge.exe	95
PID 548 wrote to memory of 5116	548	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\Visual Protector.exe
"C:\Users\Admin\AppData\Local\Temp\Visual Protector.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Users\Admin\AppData\Local\Visual Protector.exe
  "C:\Users\Admin\AppData\Local\Visual Protector.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  PID:4456
- - C:\Users\Admin\AppData\Roaming\VisualSoft\Visual Protector.exe
    "C:\Users\Admin\AppData\Roaming\VisualSoft\Visual Protector.exe"
    3⤵
    - Executes dropped EXE
    PID:4908
- C:\Users\Admin\AppData\Local\Microsoft.exe
  "C:\Users\Admin\AppData\Local\Microsoft.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Microsoft" /tr '"C:\Users\Admin\AppData\Roaming\Microsoft.exe"' & exit
    3⤵
    PID:1644
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Microsoft" /tr '"C:\Users\Admin\AppData\Roaming\Microsoft.exe"'
      4⤵
      Creates scheduled task(s)
      PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp470B.tmp.bat""
    3⤵
    PID:5000
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2092
  - - C:\Users\Admin\AppData\Roaming\Microsoft.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Private_Hacking_Cracking_Tools
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c47546f8,0x7ff9c4754708,0x7ff9c4754718
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12744571292090624256,14123431157652523412,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,12744571292090624256,14123431157652523412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,12744571292090624256,14123431157652523412,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12744571292090624256,14123431157652523412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12744571292090624256,14123431157652523412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12744571292090624256,14123431157652523412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12744571292090624256,14123431157652523412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
    3⤵
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12744571292090624256,14123431157652523412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12744571292090624256,14123431157652523412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12744571292090624256,14123431157652523412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12744571292090624256,14123431157652523412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12744571292090624256,14123431157652523412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft.exe

Path C:\Users\Admin\AppData\Local\Microsoft.exe
Size 66KB
SHA256 76b9c70c08977641458aa123b9cf587980ccf3ee10519fd7de50da6132ae1023
MD5 3f27e1d3e8718126553bcf89a78ecf3b
SHA1 d94bfe09d2f0e4436abc10a05981b8d26cb6cf6d
SHA512 e9ff23229bc4edbb2d168aa50ddca0c327af04d16eb8e3ce15f9d8f9ce7c2ae3b3a8678a97f61730265e5374aa683ea8812477763107a6f6bbd553691177e435
SSDEEP 1536:eOzLieOokWkHKuXUYFZoPDWZhVbGvzgmBhrPlTGRx:eOHieOoklKuXUYFcivVbGvjjdix
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Microsoft.exe.log
Size 522B
SHA256 2412679218bb0a7d05ceee32869bbb223619bde9966c4c460a68304a3367724b
MD5 acc9090417037dfa2a55b46ed86e32b8
SHA1 53fa6fb25fb3e88c24d2027aca6ae492b2800a4d
SHA512 d51f7085ec147c708f446b9fb6923cd2fb64596d354ed929e125b30ace57c8cb3217589447a36960e5d3aea87a4e48aaa82c7509eced6d6c2cecd71fcfe3697b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 1d5e7c9bb62dc36dbb3b046614640086214976ed9777f243cfdc8dddd1174986
MD5 2f7c3a937a56286d0a954e856d616555
SHA1 488907b4f0f15db54e043a51cb73e6fce07a2f0a
SHA512 ea567ada53fafbdb7058ab64729563df0f63d6a16bb0d4448d9e6f62ab9f69b1e53c91d941c047a5cea1459a9a63f194526c31b8da92f1d27a07c31818842d2d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4c6169807c174374bdddfcedfabf17232927a3674ccd0012f0f788ae7ac7980d
MD5 99621226bd6e38c00d9c495b8c3e6f80
SHA1 3f85098c8e6cd014a880335300fd6f8b9ddbcd4a
SHA512 e953b414f89ce261ae2ae9ce727d47213ec44ac623f014176d87bc71c7483e8b12dcce4520840ae5d527f406c31408f0b5f1c98620a73db34c9dc44773d892d7
SSDEEP 96:n8Ak1MG1eklZwpvWMoiVmdeDNu4c1jOHT/OYVID+UWQyV+VD7AiEwb:n8AkCGc+GWMTNu4chET/zKD+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 af190d129225f873d36067f1f9e126f809599bcd9526f4ea0e1e7f9637ab0308
MD5 122723a126cc8c55b5960c9b7a2afa1d
SHA1 30df1d7b69ccd0d968bd8559f82897ea57e318af
SHA512 e1eb2718c4c0f58ccce193794009163ca0997123b448c63b5cdae47e510d3b45e604fe8a2f25aecf9ff4c783fa46aac2017155c7795ce1dbcb47cb3ffbcc8494
SSDEEP 96:n8AkeMG1eklZwpvWMoiVmdeHOHTsYVID+UWQyV+VD7ziEwb:n8AkRGc+GWMXET9KD+rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d3fc4c2aafacd75a43147a3615786c42c23e8f2ced5dc953e2467cd0a4c29af4
MD5 5cc57abc815add886ea51a7a7d74d599
SHA1 07a48c212c51c842c24f3355d4e629ba76b1eddd
SHA512 ad7662d33964c813e69a18f0a02ab2ed5c276135148af6338e49ccc78b6fce3d5e5eca63231d8aad5ae10b386cc906d2f48d2c2cf5c17cde14ad4b1dcc0c19c2
SSDEEP 192:HoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptz2e2RU2X+ybRlSxvFt2p6:f9iIxuERzA83h09RZxY+tsTt2h3Coy
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp470B.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp470B.tmp.bat
Size 153B
SHA256 a0355e008ac8ac6e61badb290bfe091e114a5d4f702db878de814da5852ea242
MD5 fff6eb3bc3a7530dc040359f1895b520
SHA1 2f3d607914e03b4d49235bbecaa1ddba6941a73c
SHA512 95dfa5e419722b4a17789bdd710b6f556fca1a2a2d8f5bfa023bf96ed05a5a0c71916bb2769292f6d9202dd5fe8188b5bf516b7cf6fe987f6655ce2e820cc05b
MD5 SHA1 SHA512

Submit Download

Visual Protector.exe

Path C:\Users\Admin\AppData\Local\Visual Protector.exe
Size 918KB
SHA256 e951ba4ae0d7057f76be784018b5a6d654fd712ba612ba64ddf992e8b1772a4d
MD5 e66560e9fbefd68d816e7c3589a2445d
SHA1 984a14b2ce1267986c0d042382917030afd2c210
SHA512 79976980f123d6abb8531788985ce311dfec421df9b6e3de04de3e01efa4ad2636ce052cb24c22db2220131440ee1a1f20f58b9e079c6a19e4396c830672e57c
SSDEEP 12288:DyzIAeFz70Rm8YRvT9b1jDA94BiOT2F/KmNPCL6I3NQiCgFdmHqFqiKgLrykMw1V:DVLom8Ixb1DA9e4F/Kn6EQwmHmOgL2k
MD5 SHA1 SHA512 SSDEEP

Submit Download

VisualProtector.lnk

Path C:\Users\Admin\Desktop\VisualProtector.lnk
Size 1KB
SHA256 5244bc9ba400ae83073e9dfc9cf35c0eebf1c9cf6c56bc78ed5b5426b9b0a396
MD5 d7e08d85eab01025d6ed38fce3b5a5b9
SHA1 f0a8cadd41096651971140759334f2a4f4b5ee74
SHA512 6c9ee8534e6c37bfe24909866fb719069a8a4d8206c0c39c422d1e311f8a9e66cc9cae170d06b2b845b8c636dc67bc1a20a34eddb462a452f3e2ed379f6ff36f
MD5 SHA1 SHA512

Submit Download

memory/972-103-0x0000000074EC0000-0x0000000075670000-memory.dmp

Download

memory/972-28-0x0000000074EC0000-0x0000000075670000-memory.dmp

Download

memory/972-94-0x0000000002700000-0x0000000002710000-memory.dmp

Download

memory/972-26-0x0000000000190000-0x00000000001A6000-memory.dmp

Download

memory/2484-157-0x0000000074EC0000-0x0000000075670000-memory.dmp

Download

memory/2484-118-0x0000000074EC0000-0x0000000075670000-memory.dmp

Download

memory/2484-128-0x0000000005910000-0x0000000005920000-memory.dmp

Download

memory/2484-140-0x0000000006730000-0x0000000006796000-memory.dmp

Download

memory/2484-158-0x0000000005910000-0x0000000005920000-memory.dmp

Download

memory/4344-32-0x00007FF9C7A40000-0x00007FF9C8501000-memory.dmp

Download

memory/4344-2-0x00007FF9C7A40000-0x00007FF9C8501000-memory.dmp

Download

memory/4344-0-0x0000000000710000-0x0000000000818000-memory.dmp

Download

memory/4456-40-0x0000000005950000-0x0000000005960000-memory.dmp

Download

memory/4456-43-0x0000000005B80000-0x0000000005C12000-memory.dmp

Download

memory/4456-29-0x0000000000F70000-0x000000000105E000-memory.dmp

Download

memory/4456-97-0x0000000074EC0000-0x0000000075670000-memory.dmp

Download

memory/4456-56-0x0000000005D80000-0x0000000005DD6000-memory.dmp

Download

memory/4456-30-0x0000000074EC0000-0x0000000075670000-memory.dmp

Download

memory/4456-55-0x0000000005B30000-0x0000000005B3A000-memory.dmp

Download

memory/4456-34-0x0000000007E60000-0x0000000007F2C000-memory.dmp

Download

memory/4456-42-0x000000000A820000-0x000000000ADC4000-memory.dmp

Download

memory/4456-66-0x0000000005950000-0x0000000005960000-memory.dmp

Download

memory/4456-41-0x000000000A1D0000-0x000000000A26C000-memory.dmp

Download

memory/4908-95-0x0000000004B10000-0x0000000004B20000-memory.dmp

Download

memory/4908-146-0x0000000074EC0000-0x0000000075670000-memory.dmp

Download

memory/4908-147-0x0000000004B10000-0x0000000004B20000-memory.dmp

Download

memory/4908-93-0x0000000074EC0000-0x0000000075670000-memory.dmp

Download

memory/4908-98-0x0000000005DD0000-0x0000000005EBE000-memory.dmp

Download