asyncrat | 1a649a20bf9dd6b577ed3051786b97e41e82270d784b2dd4e51a8e952510773f

Analysis

max time kernel
600s
max time network
575s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
26-09-2024 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Anarchy Panel.exe
Size

54.6MB
MD5

94bac1a0cc0dbac256f0d3b4c90648c2
SHA1

4abcb8a31881e88322f6a37cbb24a14a80c6eef2
SHA256

50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
SHA512

30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9
SSDEEP

786432:RvcKHU1yll1EcgYwm/7hPo9b9DMs2PTUpRYj:lPU4bZwm/NwEIYj

Score

10^/10

asyncrat stealerium default collection discovery evasion execution persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:3232

Attributes

delay
1
install
true
install_file
System 32.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Modifies Windows Defender Real-time Protection settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	System 32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	System 32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	System 32.exe

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral3/files/0x000a00000001aaee-91.dat	family_asyncrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral3/memory/2448-1-0x0000000000EC0000-0x000000000455E000-memory.dmp	net_reactor

Executes dropped EXE 2 IoCs

pid	Process
1724	steamsetup.exe
3060	System 32.exe

Loads dropped DLL 1 IoCs

pid	Process
2448	Anarchy Panel.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	System 32.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	System 32.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	System 32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4636	powershell.exe
1396	powershell.exe
2632	powershell.exe
1624	powershell.exe
4736	powershell.exe
2904	powershell.exe
1320	powershell.exe
4856	powershell.exe
4196	powershell.exe
200	powershell.exe
4584	powershell.exe
3696	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	icanhazip.com
24	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5832	cmd.exe
5956	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	System 32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	System 32.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4552	timeout.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TypedURLs	Anarchy Panel.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000003a59aa7110004c6f63616c003c0009000400efbe845806623a59aa712e000000ad520100000001000000000000000000000000000000e5296d004c006f00630061006c00000014000000	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e003100000000003a593871100054656d7000003a0009000400efbe845806623a5938712e000000ae520100000001000000000000000000000000000000d8c82400540065006d007000000014000000	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000845806621100557365727300640009000400efbe724a0b5d845806622e000000320500000000010000000000000000003a0000000000d2dd940055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000008458af65100041646d696e003c0009000400efbe845806628458af652e0000008f5201000000010000000000000000000000000000006ff5b200410064006d0069006e00000014000000	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000008458066212004170704461746100400009000400efbe84580662845806622e0000009a52010000000100000000000000000000000000000061548b004100700070004400610074006100000016000000	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	Anarchy Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	Anarchy Panel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Anarchy Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Anarchy Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Anarchy Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	Anarchy Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Anarchy Panel.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2924	schtasks.exe
3792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
1724	steamsetup.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe
3060	System 32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2448	Anarchy Panel.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	Anarchy Panel.exe
Token: SeDebugPrivilege	1724	steamsetup.exe
Token: SeDebugPrivilege	1724	steamsetup.exe
Token: SeDebugPrivilege	3060	System 32.exe
Token: SeDebugPrivilege	3060	System 32.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeIncreaseQuotaPrivilege	1556	powershell.exe
Token: SeSecurityPrivilege	1556	powershell.exe
Token: SeTakeOwnershipPrivilege	1556	powershell.exe
Token: SeLoadDriverPrivilege	1556	powershell.exe
Token: SeSystemProfilePrivilege	1556	powershell.exe
Token: SeSystemtimePrivilege	1556	powershell.exe
Token: SeProfSingleProcessPrivilege	1556	powershell.exe
Token: SeIncBasePriorityPrivilege	1556	powershell.exe
Token: SeCreatePagefilePrivilege	1556	powershell.exe
Token: SeBackupPrivilege	1556	powershell.exe
Token: SeRestorePrivilege	1556	powershell.exe
Token: SeShutdownPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeSystemEnvironmentPrivilege	1556	powershell.exe
Token: SeRemoteShutdownPrivilege	1556	powershell.exe
Token: SeUndockPrivilege	1556	powershell.exe
Token: SeManageVolumePrivilege	1556	powershell.exe
Token: 33	1556	powershell.exe
Token: 34	1556	powershell.exe
Token: 35	1556	powershell.exe
Token: 36	1556	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	200	powershell.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeIncreaseQuotaPrivilege	2904	powershell.exe
Token: SeSecurityPrivilege	2904	powershell.exe
Token: SeTakeOwnershipPrivilege	2904	powershell.exe
Token: SeLoadDriverPrivilege	2904	powershell.exe
Token: SeSystemProfilePrivilege	2904	powershell.exe
Token: SeSystemtimePrivilege	2904	powershell.exe
Token: SeProfSingleProcessPrivilege	2904	powershell.exe
Token: SeIncBasePriorityPrivilege	2904	powershell.exe
Token: SeCreatePagefilePrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeRestorePrivilege	2904	powershell.exe
Token: SeShutdownPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeSystemEnvironmentPrivilege	2904	powershell.exe
Token: SeRemoteShutdownPrivilege	2904	powershell.exe
Token: SeUndockPrivilege	2904	powershell.exe
Token: SeManageVolumePrivilege	2904	powershell.exe
Token: 33	2904	powershell.exe
Token: 34	2904	powershell.exe
Token: 35	2904	powershell.exe
Token: 36	2904	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeIncreaseQuotaPrivilege	4856	powershell.exe
Token: SeSecurityPrivilege	4856	powershell.exe
Token: SeTakeOwnershipPrivilege	4856	powershell.exe
Token: SeLoadDriverPrivilege	4856	powershell.exe
Token: SeSystemProfilePrivilege	4856	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe
2448	Anarchy Panel.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2872	1724	steamsetup.exe	83
PID 1724 wrote to memory of 2872	1724	steamsetup.exe	83
PID 1724 wrote to memory of 336	1724	steamsetup.exe	84
PID 1724 wrote to memory of 336	1724	steamsetup.exe	84
PID 336 wrote to memory of 4552	336	cmd.exe	87
PID 336 wrote to memory of 4552	336	cmd.exe	87
PID 2872 wrote to memory of 2924	2872	cmd.exe	88
PID 2872 wrote to memory of 2924	2872	cmd.exe	88
PID 336 wrote to memory of 3060	336	cmd.exe	89
PID 336 wrote to memory of 3060	336	cmd.exe	89
PID 3060 wrote to memory of 1556	3060	System 32.exe	90
PID 3060 wrote to memory of 1556	3060	System 32.exe	90
PID 3060 wrote to memory of 2904	3060	System 32.exe	93
PID 3060 wrote to memory of 2904	3060	System 32.exe	93
PID 3060 wrote to memory of 1320	3060	System 32.exe	95
PID 3060 wrote to memory of 1320	3060	System 32.exe	95
PID 3060 wrote to memory of 4636	3060	System 32.exe	96
PID 3060 wrote to memory of 4636	3060	System 32.exe	96
PID 3060 wrote to memory of 4856	3060	System 32.exe	99
PID 3060 wrote to memory of 4856	3060	System 32.exe	99
PID 3060 wrote to memory of 1396	3060	System 32.exe	101
PID 3060 wrote to memory of 1396	3060	System 32.exe	101
PID 3060 wrote to memory of 4196	3060	System 32.exe	103
PID 3060 wrote to memory of 4196	3060	System 32.exe	103
PID 3060 wrote to memory of 200	3060	System 32.exe	105
PID 3060 wrote to memory of 200	3060	System 32.exe	105
PID 3060 wrote to memory of 4584	3060	System 32.exe	107
PID 3060 wrote to memory of 4584	3060	System 32.exe	107
PID 3060 wrote to memory of 3696	3060	System 32.exe	109
PID 3060 wrote to memory of 3696	3060	System 32.exe	109
PID 3060 wrote to memory of 2632	3060	System 32.exe	111
PID 3060 wrote to memory of 2632	3060	System 32.exe	111
PID 3060 wrote to memory of 4736	3060	System 32.exe	113
PID 3060 wrote to memory of 4736	3060	System 32.exe	113
PID 3060 wrote to memory of 1624	3060	System 32.exe	115
PID 3060 wrote to memory of 1624	3060	System 32.exe	115
PID 3060 wrote to memory of 4904	3060	System 32.exe	117
PID 3060 wrote to memory of 4904	3060	System 32.exe	117
PID 3060 wrote to memory of 5832	3060	System 32.exe	119
PID 3060 wrote to memory of 5832	3060	System 32.exe	119
PID 5832 wrote to memory of 5936	5832	cmd.exe	121
PID 5832 wrote to memory of 5936	5832	cmd.exe	121
PID 5832 wrote to memory of 5956	5832	cmd.exe	122
PID 5832 wrote to memory of 5956	5832	cmd.exe	122
PID 5832 wrote to memory of 5964	5832	cmd.exe	123
PID 5832 wrote to memory of 5964	5832	cmd.exe	123
PID 3060 wrote to memory of 6024	3060	System 32.exe	124
PID 3060 wrote to memory of 6024	3060	System 32.exe	124
PID 6024 wrote to memory of 6068	6024	cmd.exe	126
PID 6024 wrote to memory of 6068	6024	cmd.exe	126
PID 6024 wrote to memory of 6084	6024	cmd.exe	127
PID 6024 wrote to memory of 6084	6024	cmd.exe	127
PID 3060 wrote to memory of 4340	3060	System 32.exe	128
PID 3060 wrote to memory of 4340	3060	System 32.exe	128
PID 4340 wrote to memory of 3792	4340	cmd.exe	130
PID 4340 wrote to memory of 3792	4340	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	System 32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	System 32.exe

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2448

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1968

C:\Users\Admin\Downloads\steamsetup.exe
"C:\Users\Admin\Downloads\steamsetup.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "System 32" /tr '"C:\Users\Admin\AppData\Roaming\System 32.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "System 32" /tr '"C:\Users\Admin\AppData\Roaming\System 32.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3ED1.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4552
- - C:\Users\Admin\AppData\Roaming\System 32.exe
    "C:\Users\Admin\AppData\Roaming\System 32.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:3060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add - MpPreference - ExclusionExtension ".exe"
      4⤵
      PID:4904
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:5832
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:5936
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5956
    - - C:\Windows\system32\findstr.exe
        
        findstr All
        5⤵
        
        PID:5964
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6024
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:6068
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:6084
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "System 32" /tr '"C:\Users\Admin\AppData\Local\Temp\System 32.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "System 32" /tr '"C:\Users\Admin\AppData\Local\Temp\System 32.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\496bb16a468098f81adc475b1c71e84e\Admin@UOKLYWYH_en-US\Browsers\Mozilla\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\496bb16a468098f81adc475b1c71e84e\Admin@UOKLYWYH_en-US\System\Process.txt

Filesize
742B

MD5
ced673356115d65d87f34e0b9887fc45

SHA1
da6f6b3935b91f6e2f7264c139ed83ece189514f

SHA256
473c2cca8951c4f52bcedede7c980ccac345a91810c74040bec4e9779315e557

SHA512
8d29550e23c1ebecde62a6a7a25e3d44357ce56deddde60ca9a4b1a13078e17039b9986cc7da4339337a71bcbda3f10949cef96492f18c5a08226c8322f9fe95

Download Submit
C:\Users\Admin\AppData\Local\496bb16a468098f81adc475b1c71e84e\Admin@UOKLYWYH_en-US\System\Process.txt

Filesize
1KB

MD5
0688fb6a390a862e26a7d579f0c4fa9e

SHA1
d56876ece2ad3517158d4d92589a306e7f4c4015

SHA256
d742eabf3fbeb280e210273cb3b4f643b362a8a690623f60e83d34fe39f3d4ad

SHA512
570a921fc43cac7d3d9a2ac5e2c2f167b3d2dcf4149d8dbeb04766d289554d9abdc94434ccaa89a2589004d5da567c38c0143b7dd6166e470c2d0b9964f68463

Download Submit
C:\Users\Admin\AppData\Local\496bb16a468098f81adc475b1c71e84e\Admin@UOKLYWYH_en-US\System\Process.txt

Filesize
2KB

MD5
49cc41ef74253602eb65751e1d6ac630

SHA1
752cbce5cda46b0927c16314718d8c2081e8f36e

SHA256
dbbc02448df4d76d323b683bf94cd75668175c0519eedc086b8eed4248cfefba

SHA512
3e16dec7bd81f5a48976455bad1dea2be20ab76e9ce832b999b256c9b9854386949286c59c6e33427c2c7e8f2753001cc4829b0ff4efacc1a8a133c82407ade4

Download Submit
C:\Users\Admin\AppData\Local\496bb16a468098f81adc475b1c71e84e\Admin@UOKLYWYH_en-US\System\Process.txt

Filesize
4KB

MD5
36ca7c426e6f20cab8aeaa792331f991

SHA1
8006867c5f4376067c4d30d61509b07a479adf01

SHA256
8b6a2dbd1a5768d0755eb7ec6416cd4bc157a3de2305a3cf5dfb4061d4cba1a8

SHA512
4f57c2d437cb7166a86a1fa2b5e4f87aa27527d8b84110ee01456755937001cc675c29cec39253cfa43b253c05f6670c0fa26cc4e32f94b53e4a225eb2549e7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e4fbbedc10e25799b037f5f68aef4ef7

SHA1
1352c5f802022b1ceff84bedae99ef84146bbc20

SHA256
49b7c510f583d10dde8530cc06c1f195089ed8898b9645df07a8b5013949cfb7

SHA512
71bb5a7142f0ab52bf6daf103212205a79234d429f7cb30f204cdc43bfc3afd39ab6111f61e040c55560e69164b42f9320d3c523762ea1d334947d8068cf3aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
26bf909eddce8debd719d3dec23aa27f

SHA1
d2dd60a225253f206f1b3806a87ac806627dd6ab

SHA256
1b1a71482283f6a7b9de67787f272c43207fd734becb9f7d0d929042b9e67e94

SHA512
8d53f9399aade084f386ef3a405178bf3bc274072f4b22168ee0ed1dc85ef4a443418eb943e48e432301fba4329e61577800118ea55fff23b4e9d08b87a7d4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2820148735fa4f1b3282d806c907c4d4

SHA1
a0cdcdb86385d04307c6cf632bd4dc71d1eba390

SHA256
72648631f4343f35fae6c24977c8eb11ebae6d5ffccfb47b499fc03a2e50ad00

SHA512
da8c7051cbed9fcf05089f21fe9b4735eb605038561ef58932fb6cec7b3419456d7094a432a3f4f820a187f4f6575e17da8fce53c80d09f8019c61301c8df10c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0769182f39540a5548076576dd2c6397

SHA1
7c63f586c6fa8ffd70a565f51b4e8e9cc5e1d0fd

SHA256
63ac89a125170b3cb6f3d2efd7a3aee153d2f5816a02a391c453413dbe73a69f

SHA512
1f638d32cc289cc20f48c755455f9aeebf1375ad4d3a098bc72a52ae360a00c5b253aae71dff3e456395cb6e7a734b31b28e53d6ae2554f8cb479680a0f60976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c08bfb42f12c2021da6b55714d33900e

SHA1
3f4eca6c09e7c4dc3b17ee527cb96b053da07143

SHA256
8bc8558a039dafcb2b6ec6dc15afc8b3a10c5b9a43c6e8e81494023f2579d227

SHA512
58073ffc9e3a2725eb2b30d90a251ecd7239cdfc29a2db7507c322212d77d497cb8b880b106e0be957f2d8cfd014dff61bfb85288b64d83e1e358ddd94a2a5df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e1ea4714ed843c34bda2ba118878213c

SHA1
a320dffec943e82db9ae060738fcdafd1a5162d4

SHA256
bbfdb9db4a609576059b4f115bfc03a55a61553d7c016aa86973382242c7d1e2

SHA512
4e6e59d1584242a4718419de6125d1787d2719ae445d6bc2824c28f24e440d99e8ba879064252fd974c80ea10970eec787eca6a0d74a1cd34818816704dcc6b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b01501084b6afa6a41fac8f153184d6b

SHA1
08b4f15235fcc15be3ca8b757434a56fc84e615e

SHA256
00b45a840978ac7a00a938324e55085ef7acb2ca660475155e345ba2277d047d

SHA512
c3553db5536d6c8969f59270d2cc45726c881917b95cc895969ca477b3267a83eae927e272abf7e5fe8c7a6227595a657c7602509af32b5362984855933fccbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
19f7db347db093f26bfee520d72b9166

SHA1
4939b5abc9857a95181e1fea97f9e654542cda6f

SHA256
3f7ac7c4d235d257af240095e1aefadef14f25edc2f4f759ff624146f3b25f94

SHA512
28026f7caff1f40945c50b1267baeb17ccc37e436f7ad8efc652b6b21fa1af898b3d1e28706c00220e53c88102b823c95718ebb021343352e50a49352b257bb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
23fe64965c4c51c4a46263f03f96642a

SHA1
c905d6ac6e613a64299dc9a151c993ee0163b816

SHA256
c4bc0d75b03dc8fab3e8337488badab272fb8003c8e3651861f58cce5b23a486

SHA512
8c40ced1ef568b3d3bf49f3568b95bc719feb80fa21e83a6dace2ff187d61f9cd021f02a2a57466fac3015a90a41c226a194766776412c5645ee76e2153b1b9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2c8a729ea569bd2c66732ebaa83ecbc5

SHA1
5653f028a36b87ffa81b27050240e64efc34a7a0

SHA256
989d3cdf684311f090e6098e0f9ab19741412732537db56f4142ffe9b756e7e2

SHA512
a0fff2e419e81a35a93c1a03c609ac2a4f1af9c15c138801a6ddb2858d397a7f604c3511e8bef4ad8bfbe88d0b5f2a441fca80f8d43a120b373fb9ae1808e8bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Usrs.p12

Filesize
1KB

MD5
b0d888fbed72becacfe34d0e566fe4f8

SHA1
2e4e8a4396f1878b3875e0a30eb52806b19eb187

SHA256
e6674b838a1f1b05baef47833425007a7e5838f4a59cd16bf3231daa621eb87a

SHA512
a04ae08c537bfd1e5e30f166cb354f0fc56386be2a8d9520ea0d8fb63592feb9dfbc36cef1a0a0f2f76d7a264ebd8274a0a839edcb286e5fe95b874115f7bb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_epi15rjm.qtu.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ce3ed400-d1e84918ad678b08d2a369a3-Latest.log

Filesize
4KB

MD5
c531c3a47c34569dec61bd1383bd2f92

SHA1
5055507c9d04d2caa61dcb082b792da7b4a18a67

SHA256
13e39b73b764e7d90aa9b9183a5d5a7b0debfce55bbf62b2270d4bb5fac251a8

SHA512
1ebb48a2d4c05757a390b294d976f48a2d67c8c1c9aa684f0d2a7bf02f4b6b116de4eb1c51a4afdcc8b497f585ecbe349b4701c9689a528da0ff8bca765838e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3ED1.tmp.bat

Filesize
153B

MD5
61e17a9d04b08a63a9d05c401a0c081e

SHA1
e378426f9a1a5dc64f2aaad9d78c2aa3c545ff3e

SHA256
f81cf9945e25980adc51ede9caf0ee69462bd8912ff48b5e2ff50fac316abd6d

SHA512
155ce3c19875a7964d9f5cdb1d1e8d1f1e17f24f4ef6315b89cb5f9fe98ee4ce740a9abbdea1041b3c4d2dd6d31ba21973debf4158cfe6a2da783bcd8932f6b5

Download Submit
C:\Users\Admin\Downloads\steamsetup.exe

Filesize
63KB

MD5
026a8528c99ccddf0e2b7984705bb5b4

SHA1
16e17ec96ceab59a6359156223f9646acbb9ab59

SHA256
49b309eb2f11dc97af4054b91a4f72361370c42efac235742cad2b85872f1478

SHA512
69296608711ac741467a1e0cb2bb56e8448e33c9e57d3ab19838c906b811215ad603f9ee5ba1d0371472d08b63cbfad97204fe360b32871e0f3cb80cb918cbca

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\C5730A4C0FDD612A5678E51A536CE09E\64\sqlite.interop.dll

Filesize
1.7MB

MD5
56a504a34d2cfbfc7eaa2b68e34af8ad

SHA1
426b48b0f3b691e3bb29f465aed9b936f29fc8cc

SHA256
9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961

SHA512
170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

Download Submit
memory/1556-125-0x000001B934550000-0x000001B934572000-memory.dmp

Filesize
136KB

Download
memory/1724-107-0x0000000000780000-0x0000000000796000-memory.dmp

Filesize
88KB

Download
memory/2448-18-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-20-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-34-0x000000001F5F0000-0x000000001F5FA000-memory.dmp

Filesize
40KB

Download
memory/2448-37-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-38-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-43-0x0000000024B10000-0x0000000024C2E000-memory.dmp

Filesize
1.1MB

Download
memory/2448-27-0x00000000202E0000-0x00000000202F2000-memory.dmp

Filesize
72KB

Download
memory/2448-64-0x0000000024A10000-0x0000000024A2A000-memory.dmp

Filesize
104KB

Download
memory/2448-26-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-25-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-24-0x0000000004BB0000-0x0000000004BC4000-memory.dmp

Filesize
80KB

Download
memory/2448-1-0x0000000000EC0000-0x000000000455E000-memory.dmp

Filesize
54.6MB

Download
memory/2448-2-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-3-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-8-0x0000000004D40000-0x0000000004D52000-memory.dmp

Filesize
72KB

Download
memory/2448-9-0x000000001F790000-0x000000001FD78000-memory.dmp

Filesize
5.9MB

Download
memory/2448-23-0x0000000023EA0000-0x0000000023FEE000-memory.dmp

Filesize
1.3MB

Download
memory/2448-22-0x0000000023AF0000-0x0000000023D42000-memory.dmp

Filesize
2.3MB

Download
memory/2448-21-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-28-0x0000000023FF0000-0x0000000024268000-memory.dmp

Filesize
2.5MB

Download
memory/2448-19-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-0-0x00007FFE3CEF3000-0x00007FFE3CEF4000-memory.dmp

Filesize
4KB

Download
memory/2448-17-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-16-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-15-0x00007FFE3CEF3000-0x00007FFE3CEF4000-memory.dmp

Filesize
4KB

Download
memory/2448-14-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-13-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-12-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-11-0x00007FFE3CEF0000-0x00007FFE3D8DC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-10-0x000000001FD80000-0x0000000020140000-memory.dmp

Filesize
3.8MB

Download
memory/3060-711-0x000000001B880000-0x000000001B88A000-memory.dmp

Filesize
40KB

Download
memory/3060-705-0x000000001C630000-0x000000001C7B8000-memory.dmp

Filesize
1.5MB

Download
memory/3060-120-0x0000000001340000-0x0000000001374000-memory.dmp

Filesize
208KB

Download
memory/3060-119-0x0000000001290000-0x0000000001342000-memory.dmp

Filesize
712KB

Download
memory/3060-118-0x000000001B860000-0x000000001B87E000-memory.dmp

Filesize
120KB

Download
memory/3060-116-0x000000001C590000-0x000000001C606000-memory.dmp

Filesize
472KB

Download
memory/3060-117-0x0000000001510000-0x000000000152C000-memory.dmp

Filesize
112KB

Download
memory/3060-923-0x000000001C860000-0x000000001C8DA000-memory.dmp

Filesize
488KB

Download
memory/3060-1458-0x000000001C1D0000-0x000000001C204000-memory.dmp

Filesize
208KB

Download