asyncrat | hxxps://github[.]com/NYAN-x-CAT/AsyncRAT-C-Sharp/releases

Analysis

max time kernel
441s
max time network
441s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
13-12-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/releases

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

3o7Y2UOOdIor

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/files/0x0028000000046347-518.dat	family_asyncrat
behavioral1/files/0x002800000004635c-550.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation	AsyncClient.exe

Executes dropped EXE 2 IoCs

pid	Process
3904	AsyncRAT.exe
4756	AsyncClient.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\desktop\desktop.ini	AsyncClient.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\78633ce3-08d5-40bf-ba30-c23104bd84b9.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241213021813.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3\NodeSlot = "8"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3\MRUListEx = ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\1\0\MRUListEx = ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\1\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\KnownFolderDerivedFolderType = "{B3690E58-E961-423B-B687-386EBFD83239}"	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Pictures"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\1 = 7e003100000000008d59741211004465736b746f7000680009000400efbe8b596b778d5974122e000000020904000000020000000000000000003e000000000092f0b1004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 03000000020000000100000000000000ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 3a002e803fe0b70d29fcc64d9020ff41b59e513a260001002600efbe110000006127a643dd4bdb016127a643dd4bdb013ba3b187dd4bdb0114000000	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\1\0\NodeSlot = "6"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3	AsyncRAT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "7"	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 010000000200000000000000ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	AsyncRAT.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2716	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
324	msedge.exe
324	msedge.exe
2316	msedge.exe
2316	msedge.exe
2840	identity_helper.exe
2840	identity_helper.exe
4692	msedge.exe
4692	msedge.exe
2504	msedge.exe
2504	msedge.exe
3144	msedge.exe
3144	msedge.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
4756	AsyncClient.exe
4756	AsyncClient.exe
4756	AsyncClient.exe
4756	AsyncClient.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3904	AsyncRAT.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	3120	7zG.exe
Token: 35	3120	7zG.exe
Token: SeSecurityPrivilege	3120	7zG.exe
Token: SeSecurityPrivilege	3120	7zG.exe
Token: SeDebugPrivilege	4756	AsyncClient.exe
Token: SeDebugPrivilege	3904	AsyncRAT.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
3120	7zG.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
3904	AsyncRAT.exe
3904	AsyncRAT.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3904	AsyncRAT.exe
3304	AcroRd32.exe
3304	AcroRd32.exe
3304	AcroRd32.exe
3304	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 32	2316	msedge.exe	80
PID 2316 wrote to memory of 32	2316	msedge.exe	80
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 736	2316	msedge.exe	81
PID 2316 wrote to memory of 324	2316	msedge.exe	82
PID 2316 wrote to memory of 324	2316	msedge.exe	82
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83
PID 2316 wrote to memory of 4364	2316	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/releases
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffd43d746f8,0x7ffd43d74708,0x7ffd43d74718
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff649aa5460,0x7ff649aa5470,0x7ff649aa5480
    3⤵
    PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12452458694268499073,2583386891271435026,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2612 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:224

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap20829:74:7zEvent5088
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3120

C:\Users\Admin\Desktop\AsyncRAT\AsyncRAT.exe
"C:\Users\Admin\Desktop\AsyncRAT\AsyncRAT.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i3vds1b1\i3vds1b1.cmdline"
  2⤵
  PID:1684
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F69.tmp" "c:\Users\Admin\AppData\Local\Temp\i3vds1b1\CSC3F92EE16CB4148819F8A93B632573F76.TMP"
    3⤵
    PID:4944

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4208

C:\Users\Admin\Desktop\AsyncClient.exe
"C:\Users\Admin\Desktop\AsyncClient.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ekxdwcr1\ekxdwcr1.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2132
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES76DD.tmp" "c:\Users\Admin\AppData\Local\Temp\ekxdwcr1\CSCA158380EFEDA4908BDB5DA7D97A225D8.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n4pnk01t\n4pnk01t.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8833.tmp" "c:\Users\Admin\AppData\Local\Temp\n4pnk01t\CSC62A8FEE3C6FB41B09F6A1D7EDC5044E7.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4748
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2010_x64.log-MSI_vc_red.msi.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2716

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\34377c2d-e02e-4bf4-bbee-513bf15e16f7_12-13-2024 02;21;30.zip.6f7\Users\Admin\Documents\RepairFind.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3304
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4812
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=33E60F676FF29CBA521DDC51F797B425 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4212
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6B2DA2A09736CE9CD2CDAB64140FBBAE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6B2DA2A09736CE9CD2CDAB64140FBBAE --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4168
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C9DAC32240E0126B483637B4C6537DAF --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1740
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0E3337FCF66E3612DF9C279C2189A4F0 --mojo-platform-channel-handle=2364 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1536
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CC0887BA93531C371E4C040D2929131E --mojo-platform-channel-handle=2400 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aee441ff140ecb5de1df316f0a7338cd

SHA1
82f998907a111d858c67644e9f61d3b32b4cd009

SHA256
5944b21c8bdfb7c6cb0da452f8904a164cc951c6a4bb3a306eaebcad2d611d67

SHA512
54a2c1d4c8791ebc6324c1be052b7b73cbd74057d0ea46400cfd8e60f9a884ade60d838777eba7001cf44c924f63cba1a9708a6c71bf966f63f988c49ca70d31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
821b1728a915eae981ab4a4a3e4ce0d1

SHA1
8ba13520c913e33462c653614aece1b6e3c660a2

SHA256
36c38bde1e74c5ee75878f275a411e528c00eaa3091e7c4adfa65b8b7d28fb3b

SHA512
b8fd54808711878ed567f474f174db662e2457b6c246f625e148944532c70d94d87e96ef6febfb657895dd0eadc25906c9106fa75c6b2d3bd37ca6786f03a8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\28030ec6-04e5-4534-9206-8318cbde1265.tmp

Filesize
874B

MD5
5d7ce406d5220ba8df4cf350ca1f95fe

SHA1
029abde01964a1f066ed8dfb50baa0d27c188057

SHA256
afe473ee764720f3bd88b88b8f5ae74479fa5a435178a95810e1bde9b77804ad

SHA512
c5d1648c8fc73079124b8976c576a01e388d808151cb7f28d4ebf554a18a52fc4cc9af551f846e6768679ce136a88a3869f22e628c2de6ec90b6aeee0b566341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
6.9MB

MD5
30b1961a9b56972841a3806e716531d7

SHA1
63c6880d936a60fefc43a51715036c93265a4ae5

SHA256
0b29711ec115c27f4cd6963b9ea1e4febf15624f1c17d1c018611ee3df8c333c

SHA512
9449065743226bd15699e710b2bab2a5bb44866f2d9a8bd1b3529b7c53d68e5ecba935e36406d1b69e1fb050f50e3321ef91bc61faac9790f6209fec6f930ed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
62181cad575085a02b7553bd23bf7b2f

SHA1
8ae2ce0673a3f96b4130b43afe1c79aa758c597c

SHA256
9e9e10402875dda939cb0709db42cf35d9735c3580fb63e9cf07ff43c6b669e7

SHA512
ecbe1330a8387e2386518be8a08618c976b5d9d1a6fdb4a7da6029a6e46a3a64fd35acbcc1f4566c53242ef13df529a6d885e76221a257217b5066e4919ecf41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
29bc404651aa005a440d6fe4047ce35c

SHA1
5b5525fdaff65fcee2ea726e5022cb1c591633c5

SHA256
bc5abc9ecfaef83b702ffbc4750c09d632b2ea9fa6537389fbc453a9ccafeeb4

SHA512
b771c14437d9fb2c083a8f0334ebce72e0a8d8f1eb0a0495f5da8548f97c8a072f4ae6a85b04b01d69efa402ee987db80f9d9f4fe2535754c1d570705c56432f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
59B

MD5
78bfcecb05ed1904edce3b60cb5c7e62

SHA1
bf77a7461de9d41d12aa88fba056ba758793d9ce

SHA256
c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572

SHA512
2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
2bb0868e7385ed7fd34a6609fbf8d2f2

SHA1
f012a5af098168d132e30f6d0209e9250b35b75c

SHA256
a3ebdbcde9955fdb706e34ba3f187331d7d7f522259162a8b24471e2edf9fc1c

SHA512
5f1273f924125642d8a7a4d00798dc8a3509217d6358cb73105352e7142a5bbdd1c6711d92af9fbe26ffa5f853fedb8f434d2a5e7fdd42c297cb93e4df6826d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe57dd8f.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c2548fb8030795c1db627e38dfb56c9d

SHA1
d0088c0bdcc01c48528d14eb73ac598433afb0e1

SHA256
e29f04a6e0d8ceb8d4ce601cb2fcb916a054b4da9e8396f2eae605d2376742b3

SHA512
e214f3c6d99a6085ea8cc3e400ac2a86bb621616a204ce69bb55a7e18b55ceadaa5d15072569ab4d6eeb9d0fb3b5d06cfa6f3d6a00e0f7440b3e09bcafed555c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d85a5307750db356a32828737a07d819

SHA1
cf994efcf0d606413203b42880b83e13612d55e5

SHA256
b2f64b922f7bdbc28d371b768eb9bcb5f8b49d8d8117560ec99c482b14334a01

SHA512
1294ed8a628a11a0685248517990f0a369438cd709e0b25bbd4e689d8691396614363aa5e60b9e307633aeb1c1d0ccf8f6c5bc4a17cc01bbefdf0c7f2560d065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
957a90acda321b875bade7625bd3e766

SHA1
ba65b65484a405af37253705b7cc3d3af2415bf5

SHA256
0d233240e730cb121bc750b78f46d783c36069230f2bcd7893297d4a10bc3fe2

SHA512
575607ec8df685689429296c8bfd54018b8c8e19737d071f56bf0487937b097bc3dae5b667645bae0707c6eb3e13d6f9a5c4b26f4d02607c01fa4be08ef19181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
729df10a7e0b722edf6673d36f2040a3

SHA1
d082d92cb6eb8c0d79c9ea7e67e8b4828c5ea02b

SHA256
e2c498352af617d6d1106ea4d53c59fadc993a1f432068307250cdd0be68f7c0

SHA512
1619048945ed9b48ab2568dc546adf5173f2c60d03ee74f4616c3ffafe7182052b760feea19ce288799448c0f613b5e5592e5c547417fd7705997663439e3270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
40054cb73dd68fcf513186a36e7b28b1

SHA1
782f64c46affe72bd6b334c69aae88aa32216b2d

SHA256
136f61f0d620207ec049ca6889378a9e89d998a6ef15fbd2a8095482d8d88118

SHA512
8689097b5b94b64af0be6b51f176041b25f5464bae229b7344df07a29893d5f13498c3f88f6448b956baa7accb460e31f5ffec6eda35f31b0587b5b0a1e63c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
8e40bddfb2a9c8ebf08dbbdeb784f4f0

SHA1
1efa3e3b899d57c079c3ccd77f153046e04c44c3

SHA256
f412895d783cd41257601e60d6581536ef9ffb157e981621510c455bae9ff204

SHA512
bdedb34406950f3fdb590124df8293ad091ff9faddeaf8ce628b3e766d47374319530e660f4e47714d0d7b698eb6b2abe54e339988b0e09133519adecc7074d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
cf2a7541e7879146c53e51dab8b25b95

SHA1
50cf559e6ab34963b33d333f504cca7bb40111ed

SHA256
3c922f9f991d0cd5a0b69e774de8c43f10e12a318409071244977ce93f064ae7

SHA512
4da802bbcb2e37d0352a5cdee44819b092ad53781541f92c288cb5393a1a2cba0cd7e4da2a5e5bb6c4f0b98a4f016c03d66857426f358a8fbe4d709753f9caca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d169.TMP

Filesize
874B

MD5
d231f3124999b5c527e94ee58998e11a

SHA1
f2105b63e09be50eea2dc694e52b08c8212b0ae8

SHA256
1ee9329e1a604d9afbba7c134e2d541c49d2b5744bd31552d296fff04a5f1e8f

SHA512
173c2a8be2e565e07b0859fbc77f636e96a4597d646161f9707aeb9c4e83220eb608291cbc10afc0152b4dada3cd68e6f7b3733eba1a6f8a9005df842dc3d110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b02383c7-ca68-4147-b0ef-adcf0bd5295b.tmp

Filesize
5KB

MD5
b852fab60e0840719249b6e52018aeaf

SHA1
bc5fd6beaa96b8da77252de04308bbd797dcd39f

SHA256
f7e6c00ddf04ca576a961c6d8b6141d32dd40a83d41c69f824a078d2b4853d16

SHA512
4eaf14d91e896aae8fe8d58a09dcc5cacbd70e468e45e70b18b62e7e728fbd8369c0034a40be8ea598970e357b22f0d15b8e69da63afb29dc1b37d990d2c0f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
befe62a5af1f40eeb0684d88ff2e10d1

SHA1
90646416fc4ee9456cc1df8ca9b159c5c53a0584

SHA256
a3169cd0cf73e23fa1e48793093c717f6ac63ec6cc498c8929212d9b3e1b8478

SHA512
5e1e838a3d08fb85efe8e893a936fd9b8af488a9025cf062e14cb63d82faed54925758b55700590a4608e15dfd182f873ffbee4b7521b520ddeeea1df8f78cf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
bfcfb109784e0fdac61142e5cdc4f1e0

SHA1
e16a0e23a85b4a62487330a386b493eaa574c9fc

SHA256
c150fb8d1599fd987cf8822b2378c12857ccc63b4101e11d59cf0259167b7ddc

SHA512
7be0488a2ef5f4a104167a82764f4421abb0ca162bc2fc39e8f5472bc4212b9afdfc0859a4499f289c783a9e59f0b67f5ceb9428792a3e1d0090be45e602f713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0e0cacb1e22c03634bc68cdde9be0db3

SHA1
e51640ec3c4d989642d7fd6076e8dabf329241b7

SHA256
88940665d27ca52e77a607271120e4fadcfa0a6aab8a10269314fb9a8c11ae62

SHA512
c29866d0ff5740bcea421ed6eb17d08f729d21fa6b70a83dc9f3946cc1260fc48ac92df5943fef1d10efa5f5ef049c204d740f4b0bc2f00d6e5323c2a4d7737f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c9124afc8f38129b28d87eb19b850289

SHA1
cd58ed20958e82502216466b3dc6c29965e2fb0a

SHA256
5488d85718eca7172644e2cd3e2f06328fd3475129e5ac8991d6bb344befc029

SHA512
706e937c0178f6995dd3deda20de44e19b7248f46e70614fa2fabbf82dd8fb45affb65b361197c819e387fdcfa80b016c394b201dd7500734accff3b74b4a0c3

Download Submit
C:\Users\Admin\AppData\Local\Server\AsyncRAT.exe_Url_id0rl34oxreuuoxkuh1icsh0qae0uc4o\0.5.8.0\user.config

Filesize
319B

MD5
f71f55112253acc1ef2ecd0a61935970

SHA1
faa9d50656e386e460278d31b1d9247fdd947bb7

SHA256
d1ad588a08c8c0799d7a14509f1e0a7ae04c519102ed9d328a83fe65999e6179

SHA512
761b5c13e39bd4ae21d298084bbe747ae71c383fedf9a51fd5e9723a8b3b4547de459d82bac7f3f8f3bfc11cfb0528a4f1057b51996d7d046583109a53317b44

Download Submit
C:\Users\Admin\AppData\Local\Server\AsyncRAT.exe_Url_id0rl34oxreuuoxkuh1icsh0qae0uc4o\0.5.8.0\user.config

Filesize
439B

MD5
8521aa3937baad8a2a7b5cc5235ff8aa

SHA1
7eb5786b9963c386a8f0e9666c4ad54378401fc6

SHA256
8f64e2ad952c408bc8e12dcc0b0bf16d8778fd6aaa779ee2639ea42e94efdd67

SHA512
bd607e8d3b63e41afa351b9e41b61436f037f306b2be41397cff8b260747a5ba199e6deaefcb39f9f42c88256fcb51f624549756e66e0de34de32bf9d93fccf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES76DD.tmp

Filesize
1KB

MD5
9947ead123c5dfac6b7a9ec9084c259d

SHA1
b85cfc98a381185d7a3f45d5423814406b48a062

SHA256
e54232d87b88c39bb8ae6b340749abc7f5736172778ecd3c5e599b20298ef9ce

SHA512
7a22c71f61ba93581c58cd5d4c1c81876762f751f5a8fd5e3267054d23696318398fb6da1f782e240a98e537581277ae3f3d3a7b4e240780e514e03f5237a61e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7F69.tmp

Filesize
1KB

MD5
6dbe100b6f7062b4504fa5fd672810ba

SHA1
8634efdd0054fc53e571ac9ead5f5d5216040b75

SHA256
df09dc7c76de9dd17f762110dce2338fe08294373989ab433a7994014d90a4dc

SHA512
11328d6eb4d24a2fe657863a2b9d950e95dc1e25d40add5e7306cca161c5983c0000249ccbc6f20075ae10f7a0c2ebac9972211ae4c4badff48a9eb9d2066be5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8833.tmp

Filesize
1KB

MD5
bad4f3fac23154a83d806cddedaec947

SHA1
61717ce07a67722ccbd92e27d773b3de6bfe6414

SHA256
fc6dfeb2ecff0561430863eda205b355085fc52553d05f609effffd4e2d735f5

SHA512
03bddd93877b389fb1e5ad1342394da78e7bb0045657a6a2fd0c47b815d611d708692ca55ca971eb30f3b5aa452ebc02b93c5a48cb36bcd2d672f0cbfccfe7bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ekxdwcr1\ekxdwcr1.exe

Filesize
3KB

MD5
e7626103a35c0d8fd5c6377e9d8ff0a3

SHA1
bbab45ef53d9c5c8b29dd37245ecd4803b21abbb

SHA256
2cfd3689586684019a4f2af03e9e9b919676eadca7cb6fda0566d34fd5ac5d13

SHA512
799c1950f9d794d4c55abae2048819b91594df822254140d34b6fb30cb094c81d20f2911d0f13e5118e469a6bd3208cd92b4affbe03f5fdfc3f541a28bbb6031

Download Submit
C:\Users\Admin\AppData\Local\Temp\i3vds1b1\i3vds1b1.exe

Filesize
3KB

MD5
ed56efc046e68117ec956e2b6de5ddb3

SHA1
a05a623d66fc57fe5f83208777b08a48d08e1937

SHA256
5d8d9e5da92c6c13dad97e0e40c87a1ed2690fbf254298e282e48c33b24d1d67

SHA512
7fcb961730d320afbfe66113a6ed624c8ae8966372f3253dcc48f5540be453a3525cec99f12b9f0f391e8d3a0ace252857be4e250ed61eaef49e8ae5ebec6a99

Download Submit
C:\Users\Admin\AppData\Local\Temp\n4pnk01t\n4pnk01t.exe

Filesize
3KB

MD5
f2ef03f6fe70ea2c2ec330562275819f

SHA1
6788f5363a03d65e83fb1e271d2b4b43489274bb

SHA256
044d0b8e6f28e450b7011e2a027f729584f3e81acc22aac376283e81636d7e66

SHA512
7005968bd86c8afa7f9b3914d7bde388d3d13bf869db985dece54100cf3e6163b2a984984d2af4e3fe723a64f073dcc1e0b2341af0a731e4d695d7653ca3c41d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
f6fbd0086f2493769a55b37b7a816dd5

SHA1
ec764c1fc675988db4bbaeb47ded626c5e16be90

SHA256
1bf84e4569c0d930a9cf9ecbb2f25f686b7f41374131e5aa7d70c9ce91b20e4d

SHA512
41566dd45c1dfb0dc47625d302002a239e652cb958f92961c2642783164b99489ba5235ca6e7cfc1da9aa72f036deab11082ae81496f07dd9d9452a54198534a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
c8adc7945f9884d51e9a8e12f2b9b0c4

SHA1
b78f76f58af61215e1b5e19a8c1279bf5f1bd85f

SHA256
8f51fa6107bbceecd3b6f39be243feff75b2c85c244b9d476e1399a74e5fb94b

SHA512
014224c9fd61f72a890c7ee7c77bbf357c13cdf6d317a495fb801acb7107f1d2abab7d23402abf6a63244a8ad2ed4e109a94812c1aa606fc440dad345ef6bce3

Download Submit
C:\Users\Admin\Desktop\AsyncClient.exe

Filesize
45KB

MD5
77275a1f0e6941927bb1606750610258

SHA1
3790e7ab8a9b8da0fbe88ce8f810611e7bcba29e

SHA256
4fd622c37f6727a930fae308152c730826bfa39ce781417153a2c3b6ebca81a1

SHA512
4882ceba162bb36954bdbc030336043d8fa17f12590a28b3347cb3c8bc8bf40ed5bfe73540a25f8cb6252dad9ce4438704ab5105989be89aba7c8971f1322735

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\AsyncRAT.exe

Filesize
6.4MB

MD5
97a429c4b6a2cb95ece0ddb24c3c2152

SHA1
6fcc26793dd474c0c7113b3360ff29240d9a9020

SHA256
06899071233d61009a64c726a4523aa13d81c2517a0486cc99ac5931837008e5

SHA512
524a63f39e472bd052a258a313ff4f2005041b31f11da4774d3d97f72773f3edb40df316fa9cc2a0f51ea5d8ac404cfdd486bab6718bae60f0d860e98e533f89

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\AsyncRAT.exe.config

Filesize
5KB

MD5
cb1f2dcfeb5cbb5af8efa7ea40b8e908

SHA1
ceb040761554040cac2fc7ca18623498d3bfc7ce

SHA256
58f956abe9d717683f4a1cfa6f70e256c80461315a8d47b6456116b3d3075372

SHA512
f0d805bb7983a111b7083e08d5e53c30dd78a0a5fa2baa2af6c5d3395475a3399fd085d151cc8cce312c7eb3e11ac7c2cc78c49ff8a9bfba4b6ad6585caeaeea

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\Plugins\Chat.dll

Filesize
367KB

MD5
b230da150aa974d2a0801cef654cbe05

SHA1
ab28e63c165ebd7d43d6d0eed4de2750743b9b27

SHA256
37d41c7042210845593ddd7e5a5e37a37f6605305264d50a30aa2be1686000f6

SHA512
2d81546548b6ed2e799eaaf4766ac9a811344d9f57726bed7270e289234f7b917df07deff9d1f6e93b9f4d186daefcbfd2d0181b12406a0b5b81e3bdffa65aaf

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\Plugins\Extra.dll

Filesize
375KB

MD5
3bbcb7c7967c714f767d751db17ed1d0

SHA1
ea15b176c5c7073bfa3bb58ebe9280b032414fbc

SHA256
7dd3978e7721f4460d639d17c47fe1307917dbacfb858d0d12e403105cd47089

SHA512
c20bf3b9b4051b050b6efebbe3c6ea54e520d68172f4ef7bbab961169c4479e9c77b39719e0139edd6ff4c4366b355579226f49aa979331ac8ab8c69bf3a165f

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\Plugins\FileManager.dll

Filesize
392KB

MD5
9caa1fa3b3b7824167610d309446223d

SHA1
093fa014488ea1ddacf083c398fb8b2d07b8a0e0

SHA256
9d1b94035f381b5183e82a317f001725674c8ea1c5cd82ab5af408f7f53ca19d

SHA512
feba121ed3ccdef26b0c78874c5247cbb223b2992649fed6bbc088bfe952cf86de1145d84666048ad37b0f2c6a9dcd4da95cf972ec790b43deeb1c22322d17e1

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\Plugins\FileSearcher.dll

Filesize
433KB

MD5
4e1922ee8333847507a34823ed695131

SHA1
5df1f96b0a0a43eadeb101c54864a85cf51e9521

SHA256
a6bdd625fa1d9a7ee66e4ca09ced0b3dca8afd2ad92ecaf44fd9a879b57cb198

SHA512
e4f2bc24f7d44e19580d561599b563ef2d011cffbd64851c867b03aab22e650da55150b6bc9c02389acffe546efdcc17da72204fef4e6e49a53e27be1a290f0a

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\Plugins\LimeLogger.dll

Filesize
368KB

MD5
732839c93b7e0ab6796cb1c4544eda66

SHA1
2dc3d39d74a5b72e6320596f92bcfc15edda3915

SHA256
cd5cdf0eade067fb0d97881258e4e29d88386cc9ec7a6ea315d159d284858857

SHA512
faa264925d636fa743d0448ce97c0b26ed7974b48c2fbf66000993119749d721bc27cf2626c3eaac3b1374abc0d16cca9e8222c4da054d1aeb56b34505fbeec6

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\Plugins\Miscellaneous.dll

Filesize
560KB

MD5
07ba8685ca3faff186f0d9f5400c1117

SHA1
a673a7b55e4cf168856a7d3564a5521f0f8fc4e5

SHA256
783d9d5334aa40f35acf8ff941a6b5bed908fd94dc14a05712b8a9eb9220cd5b

SHA512
358c85a586d8b590497ea180eae76608ef38a4de09b95e907632bbad8f2c522bec4ea5568017ea1120a1553abb2be730006613872fe053b1fc00a36d005ab096

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\Plugins\Options.dll

Filesize
378KB

MD5
a1b5048e3f10f7105bd47244b2930137

SHA1
a12cbae3ec815ce704fafb0e2eadb9f31ccbb6f3

SHA256
8dc80b8bf9b3123289e132270e74a31176deec4f74e6ac20d7b6a9fcdb89e8a1

SHA512
fcae7c456f71e03afe2e67954fc3c9491978a54825436c51b351c47adb6cd8a1ef15e0e6f6d99094b986ff910e21a287a7de9e4ca2818221aa858152a8c6dfe9

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\Plugins\ProcessManager.dll

Filesize
361KB

MD5
fced22a0c1edad786a59703842fd3b14

SHA1
dceabc613c694f7f2f6439ea176988fb373d6a29

SHA256
3ad861ad9bc3edfdd486c060879f4f2450a51757c67f3b514f71381057580218

SHA512
8904c36c364d29244c598895e877d7897547ce2a187adb197ba281a0512ca3ff52464c478fc42a2ec7f614dd0f91dea2dbb31f4af81c6c0f08cd23f79a71f57c

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\Plugins\Recovery.dll

Filesize
600KB

MD5
d8793438a77750cea1b0d7eaad3d0d0d

SHA1
36bb36d6dabaa1285dbe7ba26581322630984c71

SHA256
7fd48ac68f182e0ced2ace00b223fa1d35bd8a20d75600b5400267cd5db5cc84

SHA512
68e00d97edf0ab768d40672d3b39dfcd09d8ff81b3e6abfdcfa8db88d66ae6070c8b6ad2c540538dd6f47da0174f9ab2d48cd7bef95d6021ffb844c71289822d

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\Plugins\RemoteCamera.dll

Filesize
452KB

MD5
1b2c9164e625b600e699151de11d9e98

SHA1
2ce0aa3161c641623afd1acfa922fce5f10a709c

SHA256
87938027a63a867b831c86611dc6a2c1fc6af61526dc2269328af4b59e15b1e1

SHA512
aa0785b079059463a1df409380451c2be7c3bd627a199661627815f364689ed3816dc9cb78725fab510d687d6866186f3fbdb62b633554b9a0aa324730487729

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\Plugins\RemoteDesktop.dll

Filesize
390KB

MD5
cd4a9e669264419eca4de564e6272fe0

SHA1
bb69bb1542ea06395df74dbedc98866d6c8a36cb

SHA256
56fd699258a7186f709068c283cd725797bab392e3a6f1cd28f35bbdb3e98e38

SHA512
5addb4f97c7e1cb69e5167e670bd2c3a817e0415f1fd8a5158af7e03e4340a8b1a6d803e85c9ea56415b9e7d3dcb4c352775a6a6b4770443d72114396ffaa1e5

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\ServerCertificate.p12

Filesize
4KB

MD5
d5414cca7fa31f1792c3d7021b80214d

SHA1
064a08d9d0c9407dc8eaf51e3928fa2e9c0eb28f

SHA256
96f05078eb2eb3a47088949dd7b4fd5a2fd5d534f58389a054d118707e37db43

SHA512
3b5912a7e53ff706a3d22482b9c08f81cf35b8a7beae44d9016d860b39f76297607f0709f656303f260f0db9adadd8fb2967b5f3052ce8cd2d539c98acf2e877

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\Stub\Stub.exe

Filesize
38KB

MD5
f76702fa423ce2b2b4b0fdcf547b0789

SHA1
ea408a4419e8a3139ef14df987608964c12d3190

SHA256
0e19cefba973323c234322452dfd04e318f14809375090b4f6ab39282f6ba07e

SHA512
03c7d8814687bb4f11ac41a555f368d89d5be749c92624073b77da0e57d872df201f2657b180ad0c9d5bc9ffa0a85989bf31374c7e5deefa06cf36bce3697971

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ekxdwcr1\CSCA158380EFEDA4908BDB5DA7D97A225D8.TMP

Filesize
1KB

MD5
97cd998c776ae97eabc9fefc333330f8

SHA1
3d8f18488b5613c0a53a2a8abe21ec5f51056330

SHA256
802ba99382c279060f779bd781b301a62eb210fcfc1ac976b59e937d7684ca6e

SHA512
bd675fef241c2f9a3f0c33af0f93f87ecfcf55e74648688ee0eaa03226e2cb832157c88a462c3681ba6d60726bde957479773c58fedfbfb31e9d70981f088516

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ekxdwcr1\ekxdwcr1.0.cs

Filesize
300B

MD5
a85fa53c112b4e364fa6b963a545325d

SHA1
27543fe26aa3344a677f03d5d892a543f3a7a7a0

SHA256
9048696e1de76c06e31a701b2b5f9a32361c34fb63ab1cca8574330d8152c121

SHA512
7aa25cff8c813440b7dfe1146cbe7a1213bedda48ddb819ae506616c8d97a8377dcd7fbad4b67dfd1bf5f130ba622beb7b2a546ccd18288705806b483fa4282c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ekxdwcr1\ekxdwcr1.cmdline

Filesize
334B

MD5
67d40d7a0e650861b3c42d1b4efe30b5

SHA1
090f5a7cd0abb132b7b85f6b8929def7cd0470ff

SHA256
81ab443ec6f83ac8001a7bb533b5e43b79055a7f863a3be1df478cc669ba3ec3

SHA512
e519d453e3de54b854afc155dcfc31cccc39c1defe3d8ad0ea4bab612308a753a511e206610aace30a4dafd4fe12203fe23b1e90f8501f1f851907de4c8f6341

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\i3vds1b1\CSC3F92EE16CB4148819F8A93B632573F76.TMP

Filesize
1KB

MD5
dd28b6e5f1b9a016eae9c44cc9709b59

SHA1
08c272c69a52c613d3a7d2340054d905b4af4942

SHA256
29a42c75062a99599e1668aec8db652b83e881dd55566e773d7866848765c769

SHA512
e87a7696fbeff7d99d8011bf811e5bd49fcc067d020c75c260f2532a28433ba277d3393cb7379aee63937feb5fde59f4d0a730ba31542a36ae153b2c3f5f4c5b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\i3vds1b1\i3vds1b1.cmdline

Filesize
334B

MD5
dcd5c70e63145fdc748528756b52b410

SHA1
a92a34020e82f1ffcd4a6b708928243cdcd25c71

SHA256
d1c1bd635e920e3dc71d5650ce8df98f17df582440598789a7181cf9085f8506

SHA512
0d4054ba621262911295cdd484049e32dfbff08b60af448a43de55e542972e386a6b636fef6ba406309e8acc5accc7f72c2e71b7a343c8bcb61f2f3605930066

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\n4pnk01t\CSC62A8FEE3C6FB41B09F6A1D7EDC5044E7.TMP

Filesize
1KB

MD5
3ab30eaf585c37b125dabe842e448ce9

SHA1
d2c10ba3385fb8dbb618245d55df4bb556b7e143

SHA256
92d6daae269eb9beb27fabf0bbf9e9ea627ba266d2965e19937a658a73d365d2

SHA512
75a8e2dc0cd65c14b94276d1f10cfda7e98123217a6a4238764d2b6799dd04d24aecf740e01f404780e84693958a69b64ae9cd0dbf46c6ef0921be324b79b6e4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\n4pnk01t\n4pnk01t.cmdline

Filesize
334B

MD5
56cc370753330907bc1929fb8eaea07f

SHA1
41fb38d5f319a94d270d6dca7e7a93f0bd09f65b

SHA256
a1607b8c2c2ad77c4edf55ce64f7e4d522e5810b7405998aa674466a50d8aa9e

SHA512
02088f39b27fb94d37b633f92d1c27fc29ebc1f4c188bbfe045677f0102ddf059a16f5858e0da6559ce3f26096e9325e5aaee5477b1b2dc5f3e170a4592a4f5c

Download Submit
memory/1684-612-0x000001D51C930000-0x000001D51D3F2000-memory.dmp

Filesize
10.8MB

Download
memory/3904-495-0x0000015F724A0000-0x0000015F724B2000-memory.dmp

Filesize
72KB

Download
memory/3904-586-0x0000015F76600000-0x0000015F76658000-memory.dmp

Filesize
352KB

Download
memory/3904-496-0x0000015F72E30000-0x0000015F730B0000-memory.dmp

Filesize
2.5MB

Download
memory/3904-489-0x0000015F57500000-0x0000015F57B6A000-memory.dmp

Filesize
6.4MB

Download
memory/3904-517-0x0000015F75990000-0x0000015F75AB6000-memory.dmp

Filesize
1.1MB

Download
memory/3904-491-0x0000015F71FC0000-0x0000015F72212000-memory.dmp

Filesize
2.3MB

Download
memory/3904-614-0x0000015F724C0000-0x0000015F724C8000-memory.dmp

Filesize
32KB

Download
memory/3904-492-0x0000015F75410000-0x0000015F7541A000-memory.dmp

Filesize
40KB

Download
memory/4756-554-0x0000000005C80000-0x0000000006226000-memory.dmp

Filesize
5.6MB

Download
memory/4756-585-0x0000000005840000-0x00000000058A4000-memory.dmp

Filesize
400KB

Download
memory/4756-584-0x0000000007560000-0x00000000075F2000-memory.dmp

Filesize
584KB

Download
memory/4756-583-0x0000000007110000-0x0000000007178000-memory.dmp

Filesize
416KB

Download
memory/4756-581-0x00000000072F0000-0x0000000007368000-memory.dmp

Filesize
480KB

Download
memory/4756-569-0x0000000007250000-0x0000000007294000-memory.dmp

Filesize
272KB

Download
memory/4756-599-0x0000000005A40000-0x0000000005A48000-memory.dmp

Filesize
32KB

Download
memory/4756-568-0x0000000006FF0000-0x0000000006FFA000-memory.dmp

Filesize
40KB

Download
memory/4756-567-0x0000000006FD0000-0x0000000006FF2000-memory.dmp

Filesize
136KB

Download
memory/4756-566-0x0000000006DB0000-0x0000000006DB8000-memory.dmp

Filesize
32KB

Download
memory/4756-565-0x0000000006D20000-0x0000000006D92000-memory.dmp

Filesize
456KB

Download
memory/4756-564-0x0000000006AF0000-0x0000000006B0E000-memory.dmp

Filesize
120KB

Download
memory/4756-563-0x0000000006BB0000-0x0000000006C42000-memory.dmp

Filesize
584KB

Download
memory/4756-562-0x0000000006B30000-0x0000000006BA6000-memory.dmp

Filesize
472KB

Download
memory/4756-555-0x00000000056D0000-0x0000000005736000-memory.dmp

Filesize
408KB

Download
memory/4756-553-0x0000000005630000-0x00000000056CC000-memory.dmp

Filesize
624KB

Download
memory/4756-628-0x0000000006960000-0x0000000006968000-memory.dmp

Filesize
32KB

Download
memory/4756-552-0x00000000008C0000-0x00000000008D2000-memory.dmp

Filesize
72KB

Download
memory/4756-630-0x0000000006850000-0x00000000068B8000-memory.dmp

Filesize
416KB

Download