asyncrat | c2f0e9bc6250ec69641cb2531d1a7d4cafcb35cf6806051d95b5c65fdd9cd9a1

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06-01-2025 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe
Size

13.1MB
MD5

11a217ba00b5b7debc4e3afebcbd9320
SHA1

f5e713e1fe39731c1c8981d6c17071fe5632ebc5
SHA256

c2f0e9bc6250ec69641cb2531d1a7d4cafcb35cf6806051d95b5c65fdd9cd9a1
SHA512

5b4a83c2b11c7cc7dad01a877cbfbd55328b808867c2bd6bf83bddcb9188d82f82c2ec5aaa6dfde0a60f5104c5876b3d9829cb5a3ec26665bda1bfec5d91b5c7
SSDEEP

196608:bZS+hQW1n/RNrlHAjoG+IGCsXDjDyfh9qVv4DFd4ff7ROZkJIGnMFFnblHgdRcwR:9hQgZxlHOFGCEDs9/DX4gZkGnZHk

Score

10^/10

asyncrat windows security discovery persistence pyinstaller rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.6

Botnet

Windows Security

91.193.75.169:4782

Mutex

DcRatMutex_qwqdanchuk

Attributes

delay
1
install
true
install_file
Windows Security.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Executes dropped EXE 7 IoCs

pid	Process
1964	Windows Security.exe
2968	v7.5.exe
1492	v7.5.exe
1728	Windows Security.exe
1552	Windows Security.exe
2668	Windows Security.exe
1912	Windows Security.exe

Loads dropped DLL 30 IoCs

pid	Process
2376	JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe
2376	JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe
2968	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1492	v7.5.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
2104	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BcTZJpkRAD = "C:\\Users\\Admin\\AppData\\Roaming\\BjKiHRHnPt\\pXYFDekQGF.exe"	Windows Security.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 1728	1964	Windows Security.exe	35
PID 1552 set thread context of 1912	1552	Windows Security.exe	44

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0007000000018766-12.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Security.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
104	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1728	Windows Security.exe
1728	Windows Security.exe
1728	Windows Security.exe
1728	Windows Security.exe
1728	Windows Security.exe
1728	Windows Security.exe
1728	Windows Security.exe
1728	Windows Security.exe
1728	Windows Security.exe
1728	Windows Security.exe
1728	Windows Security.exe
1728	Windows Security.exe
1728	Windows Security.exe
1552	Windows Security.exe
1552	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe
1912	Windows Security.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	Windows Security.exe
Token: SeDebugPrivilege	1552	Windows Security.exe
Token: SeDebugPrivilege	1912	Windows Security.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 1964	2376	JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe	30
PID 2376 wrote to memory of 1964	2376	JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe	30
PID 2376 wrote to memory of 1964	2376	JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe	30
PID 2376 wrote to memory of 1964	2376	JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe	30
PID 2376 wrote to memory of 2968	2376	JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe	31
PID 2376 wrote to memory of 2968	2376	JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe	31
PID 2376 wrote to memory of 2968	2376	JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe	31
PID 2376 wrote to memory of 2968	2376	JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe	31
PID 2968 wrote to memory of 1492	2968	v7.5.exe	33
PID 2968 wrote to memory of 1492	2968	v7.5.exe	33
PID 2968 wrote to memory of 1492	2968	v7.5.exe	33
PID 1492 wrote to memory of 1132	1492	v7.5.exe	34
PID 1492 wrote to memory of 1132	1492	v7.5.exe	34
PID 1492 wrote to memory of 1132	1492	v7.5.exe	34
PID 1964 wrote to memory of 1728	1964	Windows Security.exe	35
PID 1964 wrote to memory of 1728	1964	Windows Security.exe	35
PID 1964 wrote to memory of 1728	1964	Windows Security.exe	35
PID 1964 wrote to memory of 1728	1964	Windows Security.exe	35
PID 1964 wrote to memory of 1728	1964	Windows Security.exe	35
PID 1964 wrote to memory of 1728	1964	Windows Security.exe	35
PID 1964 wrote to memory of 1728	1964	Windows Security.exe	35
PID 1964 wrote to memory of 1728	1964	Windows Security.exe	35
PID 1964 wrote to memory of 1728	1964	Windows Security.exe	35
PID 1728 wrote to memory of 2176	1728	Windows Security.exe	36
PID 1728 wrote to memory of 2176	1728	Windows Security.exe	36
PID 1728 wrote to memory of 2176	1728	Windows Security.exe	36
PID 1728 wrote to memory of 2176	1728	Windows Security.exe	36
PID 1728 wrote to memory of 2104	1728	Windows Security.exe	38
PID 1728 wrote to memory of 2104	1728	Windows Security.exe	38
PID 1728 wrote to memory of 2104	1728	Windows Security.exe	38
PID 1728 wrote to memory of 2104	1728	Windows Security.exe	38
PID 2176 wrote to memory of 2036	2176	cmd.exe	40
PID 2176 wrote to memory of 2036	2176	cmd.exe	40
PID 2176 wrote to memory of 2036	2176	cmd.exe	40
PID 2176 wrote to memory of 2036	2176	cmd.exe	40
PID 2104 wrote to memory of 104	2104	cmd.exe	41
PID 2104 wrote to memory of 104	2104	cmd.exe	41
PID 2104 wrote to memory of 104	2104	cmd.exe	41
PID 2104 wrote to memory of 104	2104	cmd.exe	41
PID 2104 wrote to memory of 1552	2104	cmd.exe	42
PID 2104 wrote to memory of 1552	2104	cmd.exe	42
PID 2104 wrote to memory of 1552	2104	cmd.exe	42
PID 2104 wrote to memory of 1552	2104	cmd.exe	42
PID 1552 wrote to memory of 2668	1552	Windows Security.exe	43
PID 1552 wrote to memory of 2668	1552	Windows Security.exe	43
PID 1552 wrote to memory of 2668	1552	Windows Security.exe	43
PID 1552 wrote to memory of 2668	1552	Windows Security.exe	43
PID 1552 wrote to memory of 1912	1552	Windows Security.exe	44
PID 1552 wrote to memory of 1912	1552	Windows Security.exe	44
PID 1552 wrote to memory of 1912	1552	Windows Security.exe	44
PID 1552 wrote to memory of 1912	1552	Windows Security.exe	44
PID 1552 wrote to memory of 1912	1552	Windows Security.exe	44
PID 1552 wrote to memory of 1912	1552	Windows Security.exe	44
PID 1552 wrote to memory of 1912	1552	Windows Security.exe	44
PID 1552 wrote to memory of 1912	1552	Windows Security.exe	44
PID 1552 wrote to memory of 1912	1552	Windows Security.exe	44

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11a217ba00b5b7debc4e3afebcbd9320.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Roaming\Windows App Security\Windows Security.exe
  "C:\Users\Admin\AppData\Roaming\Windows App Security\Windows Security.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Users\Admin\AppData\Roaming\Windows App Security\Windows Security.exe
    "C:\Users\Admin\AppData\Roaming\Windows App Security\Windows Security.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Security" /tr '"C:\Users\Admin\AppData\Roaming\Windows Security.exe"' & exit
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2176
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Windows Security" /tr '"C:\Users\Admin\AppData\Roaming\Windows Security.exe"'
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2036
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpCBD7.tmp.bat""
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:104
    - - C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1552
      - C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        6⤵
        Executes dropped EXE
        
        PID:2668
      - C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1912
- C:\Users\Admin\AppData\Roaming\v7.5.exe
  "C:\Users\Admin\AppData\Roaming\v7.5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Roaming\v7.5.exe
    "C:\Users\Admin\AppData\Roaming\v7.5.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1492 -s 100
      4⤵
      Loads dropped DLL
      PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-core-timezone-l1-1-0.dll

Filesize
3KB

MD5
a84f802749ae5a0aa522f203ece20b7f

SHA1
3c631ce4107b2ffc9a4a06c16d41d7d0ea0a9b2f

SHA256
e4d28023eca5bd147ac645048b18bd7272735da10c30c2dbc83cd1c96703d869

SHA512
52b68a300ae56eb8a3b3f811cc7368afe5d4f1e8ee37b6fdae0878978952041bd5467eaaaec23aab12c1735ed3afd8134b2171b633ee1dae3b159e99d765a71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29682\base_library.zip

Filesize
763KB

MD5
351393fc3c27e6196f1d2900ed7fb63b

SHA1
5de89626d5c4ca194a27fc81435af2a9343de5f0

SHA256
265e656d9b804fee1ac2d39e9caa356ec3d3786faa21f202e8ed4eb371b32737

SHA512
84894a3820f3221475afe98080abbfa350b16aab4aa57231279408bc080ac256ed7b31c37ad72a3949e584badda399dee28ffa4bb54bd70b5b05164c0322c764

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29682\ucrtbase.dll

Filesize
971KB

MD5
bd8b198c3210b885fe516500306a4fcf

SHA1
28762cb66003587be1a59c2668d2300fce300c2d

SHA256
ce2621719f1358508c2c33bcc1380d78a737ca20cd18c0ac89f38e1be788d9a2

SHA512
c32b6c083d3a7da01085718e5685e9a04034be91251c065794ceef1dfaaf6573fdd845cbc84e926ab3f510d295649cb6e497564fbe52cc79c053357c645c11a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCBD7.tmp.bat

Filesize
160B

MD5
f63c4d8817f482cfc1339b3c0f87d268

SHA1
5d5eeb276482ca84b969c3480a710ec0e8d1a013

SHA256
bba256c7544d13dc00767f84ee6e29300ff6c32448ecd0b5702b4dd197dff162

SHA512
4ebe9fdf9a8472437f7c0a2bc6ceb3d1555862a8a0ef1a15a8c55642e0c2c28c053924476290e43048aa86071609b2f771e6c4a16089051e38d8c66c24c179df

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\VCRUNTIME140.dll

Filesize
93KB

MD5
4a365ffdbde27954e768358f4a4ce82e

SHA1
a1b31102eee1d2a4ed1290da2038b7b9f6a104a3

SHA256
6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c

SHA512
54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-core-file-l1-2-0.dll

Filesize
4KB

MD5
cb3e0dd38c444938ce1c189aadd29a3f

SHA1
45b985ccd1d30c67c757580d4e9abe6ca7be4dd7

SHA256
b2d983883afd758913a7db54222a2db4bfeb1051b0c0f92e8faae93c0bc90fc4

SHA512
cde637e676819a05cfe6f757bcb6a1aca72bd7d4422e7cedfbf9d8ba42b47eac7868a821fce93e6d0f1de20672a8de7362f9dba0066db812c74e060134fc293e

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-core-file-l2-1-0.dll

Filesize
2KB

MD5
4a18beda5038c5203993191431b98d62

SHA1
facba10698a89a42c0e419bac056366e809dedc0

SHA256
3144bccc1385efc1ff204442a5aecc0a990776341a268fad15aa605449fca04a

SHA512
fd4a1963babe134202c5b9c97b8a83c0dc1c7e58f04a5cb12f6ccf7ae6ac41f13303fb3d01052e2b670805a7e2d21c193ee888e98e68054dd52b9bdc636a7597

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-core-localization-l1-2-0.dll

Filesize
4KB

MD5
3018f5b28a9e26395b7933ebcfd6f40c

SHA1
ea38f03430f1a54e9b37e9694eabc7487b6e7201

SHA256
0c62b8ab1e5f30d4a9eadcd412677e0ab5e4e9304f0870a4ee562f08d09ccc7e

SHA512
f9a81f4565d083f30049ee8e4c4da996ba86c7c20e58d3dcd102eb41ab58c6d94941545ea2ee3aa538d352847efdd84376144ff852bdef4ea3c54dab4e5ced47

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-core-path-l1-1-0.dll

Filesize
3KB

MD5
2cd77f6e2fa6a502e352369426eae1c1

SHA1
abb54114f3677944af582afb6ea1f4a7785537c8

SHA256
e39ca111d81e6e5d90cf13fa0aee525d8a2740b84d2c5cd378dd69e4f79f8b0f

SHA512
47d47a49b8f89f64bd0d4bda344456784e8b0721f9ba32ce3b88e6dd5bec06bfb781dc44495ac17b4c50dfe679e1d18594fa91ccdfa26bed055a2c4a5c7c2906

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
4KB

MD5
004f7f67994de33959d6480ef4d4f515

SHA1
76e83db625d504d1feec5dec918552f9ec51c4c3

SHA256
053a83b3f8ac76232952bdb8fb5c5067f06ba48f82b474829c25326adbd26361

SHA512
d187950683c79b1dffe4432fb476071a203cb14d7987377f71538b81fd36077f181fb7d64e9e4e30099f239764e6cbb501b65c095cd4532bc0b2ab9fbd7755a3

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-crt-conio-l1-1-0.dll

Filesize
12KB

MD5
21ab8a6f559d1e49c8ffa3cdaf037839

SHA1
87f2edace67ebe04ba869ba77c6f3014d9cb60c0

SHA256
30b677b95de5fcbaa2ae67088822a5feabdb63a53101cc44de83067018b457c8

SHA512
6f117397ee46519a5cf29d3c8a72503861a78a83ccbc56bd4447ab2f4693857147c35292c87cb5ba5efadde97bce3735aedb0275fcabea1006c1621945a44498

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-crt-convert-l1-1-0.dll

Filesize
15KB

MD5
f5d4ef8a0c33cbf321dd51abafd5ffb2

SHA1
c85b87aa33f3fcee76facc1d0fec65f1cc5f1b55

SHA256
053e6f664d1aebe7fd120bf89056f2612b7667e1f71df0dddb504e04c58a508a

SHA512
9d85e5c320699c079df98695641f24d9baada5514435ae9b69c28ad3c3b5c29129cd46d0f8f2398fc94ade30777ed44ca5f75f6e78eb86d64ceb32c71046479c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
f5f31dc3b928073274bcdf7b4d4136f9

SHA1
07624699fd428b5e60a5ffdafe3ad1b820aa2b8d

SHA256
5cde06aaddd28e0bb3afe756215d6ae5f2eb20b00413a6a1d2095d81493c5ddd

SHA512
9458453d9530f6652f3580e988ed0f8320268a2a1a4d4a017a00935f6133fc3e8f91e8bbba07b1f628eba1a3822e4a3c3a8b72c2861950e1ede9521dd04868b6

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
13KB

MD5
861a2fd3afb4557ba49a6d60a02c39bf

SHA1
03622632d5e810b87b806ddfc0ed6ea3d2171b96

SHA256
c1a072b49acb82640104aada665ff948415cc57dfcbc495d4d85b1f18d84a1a3

SHA512
ae20bb93d7661d47048042a3a21d95f0c1b20918f170fee77cd7de2b9367a3f819b39e45cb6c58689603f1670cf3c46cdf6453162f3d88871c794df13460f374

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-crt-heap-l1-1-0.dll

Filesize
11KB

MD5
156da44de8586202cd7badda883b5994

SHA1
de58f32e2172d31a55df26f0d9a0c5ac9880efdd

SHA256
6e0460ea48738b50c8628038368e4e4b425fb6aa5de76f7fe06f2473fabc0e9e

SHA512
a80a316db9fd3f6907e28771bd39c00244f510096eab3daf617c65962bb223c728505a40dc2c3f651cc49df5d7bfa6f660ea1f9889aeb2bcf9b93a2eb6c0503e

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
10c18ee8eb974e9f6382917ad3cd7d11

SHA1
3308cd7d9d29e42e137fd348b96545c206ea7096

SHA256
3a292b3ae218086edd2d136fcc9eb65e788caa6933c864908a07f004fecd9972

SHA512
a18769ce5ef8e0da4b9bf997d9c8800e9d715c54f603cac6534cadc0ade3f9c70a0e9fc2e607d1dfd6d7326f9fb4f519466cd0953591494d0376d1624d77f1de

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-crt-math-l1-1-0.dll

Filesize
20KB

MD5
fd374a7f3079a4f7d96b4c8a1e71b1a3

SHA1
3f3c768239d26cf8c6f83af96131e7b8e85ed017

SHA256
f7117aa5df8fbfed9f625cbe11cd64fdac1220099484b3ae534107d02a99058d

SHA512
3f7d9d632e434ed01588c4eea69483197040588f09fdf0a9acb902ea59664ec2a0257723ab61fbe56545d14462be475919da8f072f5e1e720569cbb3a776110c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-crt-process-l1-1-0.dll

Filesize
12KB

MD5
9600008630390e2209199e7791185075

SHA1
7e85b6c55a2d17c0d9ffc96649a92f3e73d6757c

SHA256
0e16041aa9cff135af254e79d85b5f3944bf21e9448bc07f058894eb2013f724

SHA512
8690cde896e5731074c4a703ed0a26fe5fc136a13e57656c3a92ca5a6915ec741d587258e02e60cb4b1ccafd24e110c248641c06f8d839c0c1e235b0318491b8

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
1b923d7b425ee35cc865715e8ff2b920

SHA1
0302fe5cd576c9e28f1e9939ac04ac6ad89e371e

SHA256
fd40b4d21e907f8c168504bba248ca7eed4a84537ceec8a9903112e531b6a406

SHA512
62571b373b969889d07be3fc26146d93fed2955d6e9b336e4fc8f8759db98a8ec4154b6df5244c3b37cd3bfd7f153b2c6be7799845a02e0446c41a6898f82f31

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
17KB

MD5
d263b7ce85efdc007c40aabca5acb255

SHA1
b7fac5089b3990cddc2435138e89da2d5d515032

SHA256
37dfd6cd14f191e97e5f1674422e79febfcae062b4a56959f76ff63803e58a55

SHA512
6bc594fcb1ad5149f27c86674e78bae447e6d3f2e494e2749eaeb15af28a212dad075ec441541b490774770e77377e798a3dced94c1e9b9cfdc4f5c95bf936f6

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
1a3292019af01d7a6ed8bc52686840e6

SHA1
e1684c73ae12cd341250d544afcc539856c9bb43

SHA256
e01b24d0fe72ae8d2c76b287d1286741940b84808e4bf11514402a0a6d2706f9

SHA512
941c238c96de015d511bf691e878592ff8c71556ce95b3fba268bf9dc6a2e2ecde3c02b4dff66d3eeaf3b177624b193c42691c692e293982126ef70a10caf48b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
1bf2af4deb96801edfde04a763ea4028

SHA1
f6a9a0a603b34d212620f8b513b48039e8576f47

SHA256
e4fd646a54d9a21c52c1480e5ae36bb519a7e2237a026725570776d61a43b5a1

SHA512
42fe94de60a8eb5f3b401047316440a4f36e3184f1cb9e22f750b37627ca2a6199fb55cb950b6e5cfebbe413554128723b17bc421301768ddf9636ad3c9d07d8

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29682\python39.dll

Filesize
4.3MB

MD5
5cd203d356a77646856341a0c9135fc6

SHA1
a1f4ac5cc2f5ecb075b3d0129e620784814a48f7

SHA256
a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a

SHA512
390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f

Download Submit
\Users\Admin\AppData\Roaming\Windows App Security\Windows Security.exe

Filesize
388KB

MD5
ca18c5fd9ea0891f2d9ddd5dc0ce6803

SHA1
14013456f95550fb296a5d5a469376b039d85a1b

SHA256
c92dafeba51c0072fd15a52ade6e0fea4624b62dca789fb0dbe6c6a3543e2023

SHA512
31c7a5b020e2a27c01a42393f45b119f2789fa0f9a81b8de46cbc910c7cd111f17e017335a9a52f1d04d5ebf33a7bb2a49ac9bd1333378e0c750d3b02a703c90

Download Submit
\Users\Admin\AppData\Roaming\v7.5.exe

Filesize
12.5MB

MD5
c69141d72c70ce1f063c80b87c902771

SHA1
2890e6aee7c6f0909b09b5ed7179233faceb5f4d

SHA256
a0d38565bc116b80ff94ab357703891398f9b48970196763108f0593c1ac5a20

SHA512
c42ac50052e877039f07d95c98455cae8985e2c4fc63c02ea1913527cf28a4c3e587d0eb2747273fe4c4fa3763679d8470f7d9b4683165f73aa4fc4960ff48bd

Download Submit
memory/1552-191-0x0000000000B50000-0x0000000000BB8000-memory.dmp

Filesize
416KB

Download
memory/1728-175-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1728-167-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1728-177-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1728-163-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1728-172-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1728-165-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1728-168-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1728-170-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1912-205-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1912-201-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1912-204-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1964-15-0x000000007207E000-0x000000007207F000-memory.dmp

Filesize
4KB

Download
memory/1964-27-0x0000000000F30000-0x0000000000F98000-memory.dmp

Filesize
416KB

Download
memory/1964-113-0x0000000072070000-0x000000007275E000-memory.dmp

Filesize
6.9MB

Download
memory/1964-178-0x0000000072070000-0x000000007275E000-memory.dmp

Filesize
6.9MB

Download
memory/1964-162-0x0000000000450000-0x000000000045A000-memory.dmp

Filesize
40KB

Download
memory/2376-0-0x0000000074491000-0x0000000074492000-memory.dmp

Filesize
4KB

Download
memory/2376-16-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2376-3-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2376-1-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download