Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Anarchy Panel.rar

windows10-2004-x64

Analysis

  • max time kernel
    284s
  • max time network
    292s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-it
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-itlocale:it-itos:windows10-2004-x64systemwindows
  • submitted
    15/02/2025, 13:04

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    Anarchy Panel.rar

  • Size

    53.7MB

  • MD5

    5dc9c6fd4edbd148791b562f00876187

  • SHA1

    a2505b95d41ce293b2b2301bcb6d182266efd7aa

  • SHA256

    cd61b22206c6d49921a64d25afe25f378c5a2a9adb5cbb9bde6b8710a9b69ae2

  • SHA512

    c786dce92af961aa108222735a96cc3bc5be2d1406f205b5d5d6ebbf1835088fbab8d594259868f303cce50808ab4a52b18732dc6a343379c9b3419572c555fe

  • SSDEEP

    1572864:ptM3JU8MZutgbxMwJimb8+iq7JRCctUvKYo8+:HMJB9wJis8+ieRMKYo8+

Score
10/10
asyncratstealeriumstormkittydefaultcollectiondiscoverypersistenceprivilege_escalationratspywarestealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:3232

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium
  • Stealerium family
    stealerium
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Async RAT payload 1 IoCs
    rat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 4 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 63 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.rar"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2556
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:676
    • C:\Users\Admin\Desktop\Anarchy Panel\Anarchy Panel.exe
      "C:\Users\Admin\Desktop\Anarchy Panel\Anarchy Panel.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4920
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:4624
      • C:\Users\Admin\Desktop\Anarchy Panel\Infected.exe
        "C:\Users\Admin\Desktop\Anarchy Panel\Infected.exe"
        1⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:4896
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
          2⤵
          • System Network Configuration Discovery: Wi-Fi Discovery
          • Suspicious use of WriteProcessMemory
          PID:2444
          • C:\Windows\system32\chcp.com
            chcp 65001
            3⤵
              PID:4272
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              3⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:2200
            • C:\Windows\system32\findstr.exe
              findstr All
              3⤵
                PID:3544
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4728
              • C:\Windows\system32\chcp.com
                chcp 65001
                3⤵
                  PID:4720
                • C:\Windows\system32\netsh.exe
                  netsh wlan show networks mode=bssid
                  3⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:3036
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Anarchy Panel\loginandpassword.txt
              1⤵
                PID:3800
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_AnarchyData.zip\System\ProductKey.txt
                1⤵
                • Opens file in notepad (likely ransom note)
                PID:4800
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_AnarchyData.zip\System\Windows.txt
                1⤵
                • Opens file in notepad (likely ransom note)
                PID:1308
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_AnarchyData.zip\System\ScanningNetworks.txt
                1⤵
                • Opens file in notepad (likely ransom note)
                PID:5040
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_AnarchyData.zip\System\Info.txt
                1⤵
                • Opens file in notepad (likely ransom note)
                PID:4608
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:4572
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:4456
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:4932
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:1856
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4880
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                  PID:3628
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:1568
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:4884
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:4316
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:2100
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:2896
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4160
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:1120
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4600

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Active Setup

                              1
                              T1547.014

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Active Setup

                              1
                              T1547.014

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Defense Evasion

                              Modify Registry

                              2
                              T1112

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Unsecured Credentials

                              1
                              T1552

                              Credentials In Files

                              1
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Peripheral Device Discovery

                              2
                              T1120

                              Query Registry

                              4
                              T1012

                              System Information Discovery

                              4
                              T1082

                              System Network Configuration Discovery

                              1
                              T1016

                              Wi-Fi Discovery

                              1
                              T1016.002

                              Lateral Movement

                              Collection

                              Data from Local System

                              1
                              T1005

                              Email Collection

                              1
                              T1114

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\7d83aca3ba959afc85fefa125ed4768e\Admin@IEYJLSCD_it-IT\System\Process.txt
                                Filesize

                                831B

                                MD5

                                631b2b89ffd7a7ab7b8e702abafa6d14

                                SHA1

                                8940285a6ff4ecc9a71a56cc0b2d75527c797d31

                                SHA256

                                6d79ce20c0073ccf59a7170e48b76fb7ad9e7d48cba86608ecb6a7d6a001c99d

                                SHA512

                                f138b778e487ac4e45548ac2cb8bf459354838f3e18b6d6e0e6cc0cd754c6a6d61eb919b6f0453d6389b698836bee521365022a160f32f430028730300c36bcc

                                Download Submit

                              • C:\Users\Admin\AppData\Local\7d83aca3ba959afc85fefa125ed4768e\Admin@IEYJLSCD_it-IT\System\Process.txt
                                Filesize

                                1KB

                                MD5

                                aea167badeee095466a86e367a056ee3

                                SHA1

                                0641be045c00d40e8689bd07c157b8333d28d9f7

                                SHA256

                                24b3a776b1a2b2603b60e5a6914b2c2dfde44409a7f900938f4c2beaf6ece471

                                SHA512

                                363714fbcea7a1f6a1d651f5bb31d08bbacc6c3f5f7ffb895ece07ee19c384c07362ce849592e02abed8ccb7e6978db8bfc8c5312de8592ce79dadcfff03117d

                                Download Submit

                              • C:\Users\Admin\AppData\Local\7d83aca3ba959afc85fefa125ed4768e\Admin@IEYJLSCD_it-IT\System\Process.txt
                                Filesize

                                3KB

                                MD5

                                de525b6d322bcc1acfe11673e30fdcf1

                                SHA1

                                478ebf571c4879d57f3330e74e89ebb3cb5ad441

                                SHA256

                                f3e10bccb5fdd9f885a014c247f4c83fe845801c91c224859df1611753abc034

                                SHA512

                                c90ea0edc8496c08b03384586bf09c55324f411a4d1043a7d90a9c65e2cd93943c5822999b3dde62a950eedf56be93fb4db393adc189fe638ebf5ca4fdaa0ea5

                                Download Submit

                              • C:\Users\Admin\AppData\Local\7d83aca3ba959afc85fefa125ed4768e\Admin@IEYJLSCD_it-IT\System\Process.txt
                                Filesize

                                4KB

                                MD5

                                031531e6f9a8e1f63ed08c77c61ced13

                                SHA1

                                497583cface33014ceea6166282698d6c3dae449

                                SHA256

                                eeae94fb70cee61fe204d8b18704625b05c831f9e878e30c5f66472380d12fcc

                                SHA512

                                9600e1411cda325b325cb1b049da58d2b3d98c679068685d0b4fe982b403c57b5e82e43125df4319ac7965b225e1e6a44c10b6c5b97666e1b5660b7b104521f8

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133840986601313349.txt
                                Filesize

                                75KB

                                MD5

                                01c536885b5b84979ebe1de87e9131da

                                SHA1

                                4214edcc6da33dcf94dada8fc187f127c2d66ef8

                                SHA256

                                643296211d03a0a30930d328c0c7d5e7054cea4f60d25f9d9e7f1b3a3632afcc

                                SHA512

                                86160675a0f8f005300faf1ca4162d986561d00e714215abae5cace213e1016e0772f445ca6a72bfdfa6ce662a905b193f98fad0a2d96381c56749208ac194c9

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Costura\C5730A4C0FDD612A5678E51A536CE09E\64\sqlite.interop.dll
                                Filesize

                                1.7MB

                                MD5

                                56a504a34d2cfbfc7eaa2b68e34af8ad

                                SHA1

                                426b48b0f3b691e3bb29f465aed9b936f29fc8cc

                                SHA256

                                9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961

                                SHA512

                                170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

                                Download Submit

                              • C:\Users\Admin\AppData\Local\VyLcvAjyZL9oUxnI4mJV\Anarchy_Panel.exe_Url_ngizoguis4xqpklht0y4p0amnsr1wb5h\4.7.0.0\user.config
                                Filesize

                                1KB

                                MD5

                                495d368baef768dd527dd8b772702c87

                                SHA1

                                20ceb83c7076024e0491f169173607aa4a2e3931

                                SHA256

                                38f1820a88401c8e117bfeca56a11aa06dc806a175203e86f323dc6fb81fb3cf

                                SHA512

                                75770717f4bc7c9bdd13d747fdcd6306c38423b1b5d908b5d7cdf4da1b7bbe722f65bb52e63c61ca6da89981d8f5a99035c1d610a0fdacb706a046520c291d18

                                Download Submit

                              • C:\Users\Admin\AppData\Local\VyLcvAjyZL9oUxnI4mJV\Anarchy_Panel.exe_Url_ngizoguis4xqpklht0y4p0amnsr1wb5h\4.7.0.0\user.config
                                Filesize

                                1KB

                                MD5

                                4b01719ab493b81d429c574dbaca15ef

                                SHA1

                                719ef1e4e6616a3d8afce09de7f89ddcf186a3a3

                                SHA256

                                33ce546b728989bc9ff5dd4c487a87723e5eb7b3953b7cb56e747747411b6c54

                                SHA512

                                4d5293d8b58c793bbbe6dedc061cb4fd3e7302771ee91789240ecf80f2f79d08dffc36d148f755107a3d12de6037ab18c57cb42494de80a40d90b64bb04ef234

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Anarchy Panel.exe.config
                                Filesize

                                3KB

                                MD5

                                3d441f780367944d267e359e4786facd

                                SHA1

                                d3a4ba9ffc555bbc66207dfdaf3b2d569371f7b5

                                SHA256

                                49648bbe8ec16d572b125fff1f0e7faa19e1e8c315fd2a1055d6206860a960c9

                                SHA512

                                5f17ec093cdce3dbe2cb62fec264b3285aabe7352c1d65ec069ffbc8a17a9b684850fe38c1ffd8b0932199c820881d255c8d1e6000cbbe85587c98e88c9acb90

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Infected.exe
                                Filesize

                                63KB

                                MD5

                                64ca5c257f4d056be7b96a9db33f0ebf

                                SHA1

                                515b613c389ae1a1abf1f6e27752b6258a71993d

                                SHA256

                                a19a10f5758e7f5d2d543089d966c1328814b67b6123ea755da68ae18a78eac6

                                SHA512

                                6707f904176449a48fa58b9b05fd1f4024cfb24317366426fee6c5bde54ef2ce288fe6389149f5baaff24c4bc2e9869e8ef040055c887f7ff215f70947bf0064

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\0guo3zbo66fqoG.dll
                                Filesize

                                78KB

                                MD5

                                e4ebcf76ff80ef398d3ab77d577f4c08

                                SHA1

                                cb9e6b30a63d50ae87610f6855b64abfb25691d2

                                SHA256

                                9661b1abc9a3e95e591c49c3838a64a066a2ff3c6de08d8aa7b541c4a75cd8e5

                                SHA512

                                8f37cedd987dd14181fdfa861b8a95271868dac21aa9df80bd6daa831ae20f4b4965c8be3e36f32aa220bd37ded11a7568ae237c9c9641bb4fc087f6fe104b01

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\59Zp7paEHDF7luJ.dll
                                Filesize

                                4.0MB

                                MD5

                                15e3d44d37439f3ac8574ac1c9789ec2

                                SHA1

                                bb3ef30e9f4496198f412738579966210ade36e0

                                SHA256

                                5db4c26057a05bb75ff7892fb60fd76620fc2228811d913d152a0aa4ec9db7a5

                                SHA512

                                ff358c9896792017ff7e91f1dedffd9d75a099c5b852da19599799aeca20b6b269267ff7c12c918a2530fe1a79a12bc8796c4eb3914c97faba3eba27388abde1

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\CjETR6GpGXqM.dll
                                Filesize

                                395KB

                                MD5

                                b0fc0ba80f8ec9586ff397412c512d9f

                                SHA1

                                0f6051b71b715a47be1fa16683201413905629a3

                                SHA256

                                13db80a0211ba9bf59a1e43bdb2fffa91de5c7f38bd469c4824b5e06245a0234

                                SHA512

                                222a365ae567c6c773ca2b99b82795916839cc5c9ba8eb019bf6713108720c2793303ef6612b64488f4584602cec84c0b48a02fe709db0250bf377d07e002d7d

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\EVa7gBMKoaHmLC.dll
                                Filesize

                                170KB

                                MD5

                                64a3d908b8a5feff2bccfc67f3a67dbd

                                SHA1

                                a17d7e5fa57c99a067cac459cb507b625dac254e

                                SHA256

                                6ea1ae7ab496666c0117fc20e704bfb6104b13cfb0408073a09689f863fa64b1

                                SHA512

                                66374d720230799bea6ac6cfe3faadc37fd775a49d40c04facae1caf1ec658956bbda54ba75287d7128b19b97971bd933a64469da8e0884225c5a8d8b9423ccc

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\FBSyChwp.dll
                                Filesize

                                170KB

                                MD5

                                0d41ccfaa8e7ef96248b8270d1a44d08

                                SHA1

                                6ee22bdb91d3a18e0b45b6590eb69bc9a0b02326

                                SHA256

                                0ea38d0d964815e2b84748a78bd5a829ae01586478e5f17b976f1ae763c8dec3

                                SHA512

                                a0f236f6dbeb1763fb1c198616de65b907a3a5edf7ed9435c2ad0b5826d84e9d2f25e96aba4e8b681ef495612cf0e04e929427a92d332164ace89e797bcb0e0e

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\G3nl0mDcABnDuZ.dll
                                Filesize

                                177KB

                                MD5

                                97b8bec4c47286e333cc2bedacf7338e

                                SHA1

                                764bbd0307924b71ca89538b42996208d10c9b91

                                SHA256

                                060d467cbeb0a58696287c052f3dd9b3597331b1c812e3e2882d6c232f8511de

                                SHA512

                                a40970622a594533349e75fc2022314ba21f05fc82709d6eaba82f4a2bc343c960029ad2825cfc034ce82622722127d149993bff88982f02d6dd6b5b1fb60fbf

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\KNTmoSnG.dll
                                Filesize

                                670KB

                                MD5

                                738c096a9bc38e21a9aa59ebc356c80d

                                SHA1

                                139756ad201a537461a6bb8524a4b89a63b1b1b9

                                SHA256

                                300a5551f7be89c5f03c0b70fa7dafb7f84c6394dac68bee95169e985e7786f0

                                SHA512

                                294c34f0716861fa67ba571bf7a8614613a1746e9f2935ba0c86eb1897dff858ea1f7fb44f1b6ec87cc709f4933a912dcd3eadd5d0b208c72985aa47e1f214f2

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\PK0TcnqTGFagQTS.dll
                                Filesize

                                174KB

                                MD5

                                fa90a2aee0d172000257c4faca31237c

                                SHA1

                                b317281b4acaaf1d7b7255c5e92887322abae892

                                SHA256

                                991fc53fa1aa7b5cd0b6e19dab536873d68e4413fd55b533601a3a2582d38a49

                                SHA512

                                b05c0b52e011089258ad31dd23a1f8a0cc8145b202e42e2a9d4fdf892c12d4a7b5843cc7721041295ab796e8bc98747b9e321c4e54bfd1a7c9a02dd2796fc405

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\RssCnLKcGRxj.dll
                                Filesize

                                181KB

                                MD5

                                f6808c4fbbe0275db03b2cc5b4c2bc0d

                                SHA1

                                e40b61c64c68f72fc5144f5057d54229babdecf8

                                SHA256

                                e204d15f0e7269d364157aaab265a5dfbe7e76c9f6202bf90998f0edd77ca248

                                SHA512

                                f077c49f6943d0e40799b3b42d1e11f50dabca48305c36ef2acd3258c990e0e0f982fbb0c27b1243aa15d2ed7b398b70f07dddc9ba76ff032ba74a24c8e08fb4

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\WkUP83aP9CABpi.dll
                                Filesize

                                86KB

                                MD5

                                8dbfb67c059aa59f7c53e20ef6740363

                                SHA1

                                3de96e7f48ee7647f5a7c2efb68cbd914bc78364

                                SHA256

                                a74b74f463d567c1f0505bddcd49ed23700f9ab7dcf4b7f46435723258c5a7e2

                                SHA512

                                70aed01375416e2be63d676bbdba58c12ba5f50d406d1fe252e7a66b901d32e0705007dbf465193de51663174c1b53bdb980890d8b2e6ce641dd16a200e3440d

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\eMTYbTz0gueNs4.dll
                                Filesize

                                1.1MB

                                MD5

                                5dfbcfbbf9e2ae7db23e252808699ffb

                                SHA1

                                a1d429292fe73aeb5abab10304e1ae8c1262b26d

                                SHA256

                                929e5f15e9ceca03c80b2d174283cb25bf47adfe4693f5c01f622416c9f6d03c

                                SHA512

                                9ee63080781577e0d818a27d026024f96161bb7b132dc0c130fabbe2d6c3b7758868fff5a4ad68efeb4d08f964e2f69417022751880a443f7f920aa4f40f5c09

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\fzAgyDYa.dll
                                Filesize

                                79KB

                                MD5

                                a5770798b7a6465f5b5a8c19d7d707ee

                                SHA1

                                ca67e9591d2f757cbbfacb55f27aec6485b10ee6

                                SHA256

                                f855353a618af8a53504b5188c05d3a09fb1ff85763e0cd15c53dee82d7c6119

                                SHA512

                                64da7687e83c6ff4d1c1cdc644ffff53333f745e82f169beb529d55ec5be6f21658d27c6e01744147c00f834978260e86ea627a5f2981f27305afb69a7b467dc

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\mGWHaG2Jn.dll
                                Filesize

                                81KB

                                MD5

                                8f98206f577160f950d456d1190c8d32

                                SHA1

                                defced38fce00775c4616b420fa674d77f946eff

                                SHA256

                                2bde0293c982fb6266c683ecaa2c90372d26d9a2786726874a2cfb89dcc68324

                                SHA512

                                432c2b6759701754616273633c966332e718dbb10a9a7eab0d7c57ffdc9be95b5e1b16b6e291301ac7aa6d1de48a46d30f08729e45d6634b1849f41c78e92d91

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\mML6WKMqdxjDGA.dll
                                Filesize

                                173KB

                                MD5

                                e03b206eec8a7efbd1a47909071226e5

                                SHA1

                                21163989ea524920e874bc7932adfcd5e94f854e

                                SHA256

                                778877431354a9584325dadb663be077f757227eaae8bcad33e4bf26efd6b965

                                SHA512

                                831ed74419f1b4c3250fbff20be16ed7058a851d7168a17e8a4dcf284a19412feee42a8c198af34b37571de33a80c48ac855f5d018ea9e2cfdcd846b832155ff

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\oYsKwDG.dll
                                Filesize

                                4.8MB

                                MD5

                                a718955297276f2349b7644447736e08

                                SHA1

                                377388d115b77aff357dcaf92b6aeb6286b1460d

                                SHA256

                                54ec206c8fe8ff27b3fb02ef892b8e6bc4b6abfff2fe08f5f57175c64f1d3220

                                SHA512

                                a3c2ded0cdc4e62adac92a569d6cd4db0c3647e663700f019a9de27e738eb2672e5cccec19af15633a3cd25a882452ff5ce39c17f67dc3ed6653b9e0ad063641

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\rNXXgmX25s.dll
                                Filesize

                                1.5MB

                                MD5

                                050f07b46987eaf152aab521c0112fc4

                                SHA1

                                2d2c0943ce9c10ba09b0d5cca54c2a88a1e61e95

                                SHA256

                                b93374fdfd9af786ff20597ae0e242b81373984ba5718194f9e57feb231c52cf

                                SHA512

                                a27c370e40ec126b6b9f3ab7d603378c2b629ec752aa8fc57a10e3ef58c0b701a5d1b4903a17ba180c4e73e76b54304f0868c474eb60e671562d0deed83a18c8

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\sJ88z8tsg5XzK.dll
                                Filesize

                                172KB

                                MD5

                                b3fa2c3d50057ddd2c9579dc0aef1590

                                SHA1

                                88a1f57b9177c95a2e095866574639b09d5f310a

                                SHA256

                                6eaf5744b8ec91312e1c6be83d852627e5204b3b64a1932e60e47438d73fb6bf

                                SHA512

                                0d1b8288cbc1c206029fe2f9b7366b2f8b49158e4c9643e453111ceb90fd77af903533c64f6ede351755414c9e7daa926704cda6f1953be79e1adc7aff515508

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Plugins\yL9x34D8X3oO2P.dll
                                Filesize

                                180KB

                                MD5

                                38502e61cc1d39095a12c1883551ad9f

                                SHA1

                                135c9cad9e6d54bf66a1cee5c99ba510102623b0

                                SHA256

                                0e9733277eac197c4eaf40fb0eada0907388222ef21843488a8e591149768301

                                SHA512

                                cd67a63ea954a4db8c8dfadceb2822b447d98c2c43a8f9c6901d0fce3230605a0416395b92caea6ac08348d5f6b0e1cb052b24cf90829602b0a5b0652b8a2600

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\Usrs.p12
                                Filesize

                                1KB

                                MD5

                                d3329e96031efae033873ab280ee08ec

                                SHA1

                                19460f48c4448083a901cdbb3229223cb8f7018f

                                SHA256

                                b62e244de4d836e50dd7e5e4fea9371de617403259ac57f75e10f50ebae4e0f8

                                SHA512

                                c99f5939d62f24ae572d362a97e81d9ece32d47d43b3e803bc34269263e74c3fb1dd2ca2f40430a21641815915ce3382c93484851e952764f6a16940284d0010

                                Download Submit

                              • C:\Users\Admin\Desktop\Anarchy Panel\loginandpassword.txt
                                Filesize

                                90B

                                MD5

                                7ee98887cd3550deb1e601361b5821f2

                                SHA1

                                f8b97ee5d34be89446a31ebf87e6dfbceddc5479

                                SHA256

                                eccf16f811dabab40436d06dcf15b05d00f084b0dc5911ae1ea23cd08f4ce41f

                                SHA512

                                e0d56654c738072b6c3a6c4f2f1173900d5bf9480f82a8784fd8f03f7cf75327dad918f1d68121caedcdde15db7cda89d4c61d28518f2383699e1c963ed5ea38

                                Download Submit

                              • memory/1568-501-0x00000000041B0000-0x00000000041B1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4880-334-0x0000024423380000-0x0000024423480000-memory.dmp

                                Filesize

                                1024KB

                                Download

                              • memory/4880-345-0x0000024424360000-0x0000024424380000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/4880-358-0x0000024424770000-0x0000024424790000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/4880-339-0x00000244243A0000-0x00000244243C0000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/4896-116-0x000000001BDD0000-0x000000001BF58000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/4896-324-0x000000001BD50000-0x000000001BD6C000-memory.dmp

                                Filesize

                                112KB

                                Download

                              • memory/4896-115-0x00000000024A0000-0x0000000002516000-memory.dmp

                                Filesize

                                472KB

                                Download

                              • memory/4896-100-0x00000000001A0000-0x00000000001B6000-memory.dmp

                                Filesize

                                88KB

                                Download

                              • memory/4896-117-0x0000000000B80000-0x0000000000B9E000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/4896-122-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/4896-506-0x000000001BD00000-0x000000001BD34000-memory.dmp

                                Filesize

                                208KB

                                Download

                              • memory/4896-503-0x000000001D440000-0x000000001D90C000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/4896-502-0x000000001BC50000-0x000000001BD02000-memory.dmp

                                Filesize

                                712KB

                                Download

                              • memory/4896-327-0x000000001BD90000-0x000000001BDC2000-memory.dmp

                                Filesize

                                200KB

                                Download

                              • memory/4896-261-0x000000001BFE0000-0x000000001C020000-memory.dmp

                                Filesize

                                256KB

                                Download

                              • memory/4896-282-0x000000001BBD0000-0x000000001BC4A000-memory.dmp

                                Filesize

                                488KB

                                Download

                              • memory/4920-62-0x000000001E670000-0x000000001E682000-memory.dmp

                                Filesize

                                72KB

                                Download

                              • memory/4920-66-0x00007FF8DA923000-0x00007FF8DA925000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/4920-63-0x000000001ECC0000-0x000000001F2A8000-memory.dmp

                                Filesize

                                5.9MB

                                Download

                              • memory/4920-68-0x00007FF8DA920000-0x00007FF8DB3E1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4920-64-0x000000001F2B0000-0x000000001F670000-memory.dmp

                                Filesize

                                3.8MB

                                Download

                              • memory/4920-67-0x00007FF8DA920000-0x00007FF8DB3E1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4920-69-0x00000000230F0000-0x0000000023342000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/4920-70-0x0000000023870000-0x00000000239BE000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/4920-71-0x0000000023A00000-0x0000000023A14000-memory.dmp

                                Filesize

                                80KB

                                Download

                              • memory/4920-72-0x0000000023BA0000-0x0000000023D2C000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/4920-56-0x00007FF8DA920000-0x00007FF8DB3E1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4920-79-0x0000000021C00000-0x0000000021D1E000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/4920-65-0x0000000020C30000-0x0000000020D32000-memory.dmp

                                Filesize

                                1.0MB

                                Download

                              • memory/4920-53-0x00007FF8DA923000-0x00007FF8DA925000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/4920-55-0x00007FF8DA920000-0x00007FF8DB3E1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4920-54-0x0000000000530000-0x0000000003BCE000-memory.dmp

                                Filesize

                                54.6MB

                                Download

                              • memory/4932-333-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                                Filesize

                                4KB

                                Download