asyncrat | f6aaeb3d9ea91538739ed36f5b8f53eac68b0050562e3f14019ad4ab8a9a7d53

Resubmissions

14/10/2026, 01:54

261014-cb2f9sty7k10

14/10/2026, 01:51

261014-b92dgsty5p10

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FL Studio 25.exe
Size 144KB
Sample261014-b92dgsty5p
SHA256 f6aaeb3d9ea91538739ed36f5b8f53eac68b0050562e3f14019ad4ab8a9a7d53
MD5 2bdcc6d42079cd43ad269d2ad57b5ba9
SHA1 870f91a6765e694474adc64c41f396ea6a8d85dc
SHA512 5c46210d202505a8324dbe6bf9b27504884d92b9ddb928fe8522d359e362d828d40b4dc6e126f8418387a0739b21d89fe7f0c7e270d9eabb2dc4bb0a2706efa0
SSDEEP 3072:vuYqTsAvSX2DtiF3bc5rg8ZcETg3+vhjNZQfGZLDaTIOYWnj:vuY6vSGx83bEZtj7QfGZLuOi
TLSH
T1EEE38D0C2FD5471BD3597AF45DA3D355DC7FAE623102DB4A98803BBA1E22AC325035AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Mutex

CJjWFKOVKRYV

Attributes

delay
3
install
true
install_file
FL Studio 25.exe
install_folder
%AppData%
local_host
127.0.0.1

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000a000000024381-9.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	FL Studio 25.exe

Executes dropped EXE 2 IoCs

pid	Process
3744	FL Studio 25.exe
1628	FL Studio 25.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
812	cmd.exe
3580	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FL Studio 25.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FL Studio 25.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FL Studio 25.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FL Studio 25.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FL Studio 25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FL Studio 25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FL Studio 25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4876	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
868	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe
2532	FL Studio 25.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2260	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	FL Studio 25.exe
Token: SeDebugPrivilege	3744	FL Studio 25.exe
Token: SeDebugPrivilege	3744	FL Studio 25.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 812	2532	FL Studio 25.exe	93
PID 2532 wrote to memory of 3580	2532	FL Studio 25.exe	95
PID 3580 wrote to memory of 868	3580	cmd.exe	97
PID 812 wrote to memory of 2996	812	cmd.exe	98
PID 3580 wrote to memory of 1628	3580	cmd.exe	102
PID 4028 wrote to memory of 2260	4028	msedge.exe	120
PID 2260 wrote to memory of 3764	2260	msedge.exe	121
PID 2260 wrote to memory of 3248	2260	msedge.exe	122
PID 2260 wrote to memory of 4876	2260	msedge.exe	123
PID 2260 wrote to memory of 3248	2260	msedge.exe	122
PID 2260 wrote to memory of 3248	2260	msedge.exe	122
PID 2260 wrote to memory of 3820	2260	msedge.exe	125
PID 2260 wrote to memory of 3820	2260	msedge.exe	125
PID 2260 wrote to memory of 2248	2260	msedge.exe	126
PID 2260 wrote to memory of 2248	2260	msedge.exe	126
PID 2260 wrote to memory of 2248	2260	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\FL Studio 25.exe
"C:\Users\Admin\AppData\Local\Temp\FL Studio 25.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "FL Studio 25" /tr '"C:\Users\Admin\AppData\Roaming\FL Studio 25.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "FL Studio 25" /tr '"C:\Users\Admin\AppData\Roaming\FL Studio 25.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF6AF.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:868
- - C:\Users\Admin\AppData\Roaming\FL Studio 25.exe
    "C:\Users\Admin\AppData\Roaming\FL Studio 25.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1628

C:\Users\Admin\AppData\Roaming\FL Studio 25.exe
"C:\Users\Admin\AppData\Roaming\FL Studio 25.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultaa84c0f9h43b1h456dhb3e7hd0e6a6c8108f
1⤵
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultaa84c0f9h43b1h456dhb3e7hd0e6a6c8108f --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ff82863c188,0x7ff82863c194,0x7ff82863c1a0
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,14241604417549563012,15428756183648487496,262144 --field-trial-handle=2292,i,15160490564007242701,68864773983274018,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,1316789088740945037,12070589768707238830,524288 --field-trial-handle=2292,i,15160490564007242701,68864773983274018,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,17078750093548190102,7646731131305842558,524288 --field-trial-handle=2292,i,15160490564007242701,68864773983274018,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3252,i,4574476853618030341,9306827474473534507,2097152 --field-trial-handle=2292,i,15160490564007242701,68864773983274018,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:2
    3⤵
    PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FL Studio 25.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FL Studio 25.exe.log
Size 614B
SHA256 9ed5449a36700939987209c7a2974b9cc669b8b22c7c4e7936f35dda0a4dc359
MD5 54920f388010333559bdff225040761d
SHA1 040972bf1fc83014f10c45832322c094f883ce30
SHA512 e17aa5d1328b3bfd3754d15b3c2eded98653d90c7b326f941522e0b3bd6f557880246a6bc69047facb42eb97d2e0ed6c46148dfe95a98669fc4e1d07c21a285c
TLSH
T109F08B303722E1D88D522F521C2C7A9953EF078AB7A0DF2C7958536EDC26557AB211E3
MD5 SHA1 SHA512 TLSH

Submit Download

04854b3b-e67f-473b-8675-a1111490f812.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\04854b3b-e67f-473b-8675-a1111490f812.tmp
Size 9KB
SHA256 e8cd0312dee24b1b176dea527281e374fedd6ff7ad21724ddb2abaf5ae3db34e
MD5 6963d5ae8edc378b37eb151cf46dceed
SHA1 3641bd53a99e74d1f4bbd844e816ae36e941591e
SHA512 556083eeacd19fbb3c876dc0f6be06988134bd6f0e6ad867c8897ec469e518518717ea1dd456f8cce77d3f6603c46a7d37ee5140d3dca8281157daa2cc943705
SSDEEP 192:zMsNdC6nnHCUQmiUyUMwcbcX5hQDP1yOO/HGFfE9ogyNuq5VLUO:zMsNdC6nikTzcQX5+DtyOO/Hq89GNlJX
TLSH
T18E12F931A8A8FC378DE6A555F5C632A39FA52177E8446FC0E5D81E1C00D779C274AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ff8ffd1-e7d3-4421-818f-9e85d2511080.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ff8ffd1-e7d3-4421-818f-9e85d2511080.tmp
Size 8KB
SHA256 10cd1da645e3f3103b9e4fd31d3b781ffee8e6d82a3a6edbf4c7a4b482837aeb
MD5 d8dd213513a38679c98fcf6f1a924322
SHA1 b370e6b6cc1cda37286deaeee5a74b48ebe85c8f
SHA512 b0b331fc93554ce10a2b11d30bd2683b72fd164f90a6e5c34c3780415b2ccb1a85fd590688b24aefe51ad41501f35a1bc5547e65088066ff9e1a3714a67cf79d
SSDEEP 192:kONL6nnH2QmiUywMbcYcX5hQDP1yOO/HGFfE9og3aq5VLU6:kONL6nyfIcNX5+DtyOO/Hq89ThJU6
TLSH
T193120A31B8A8FC375EE6A555F4C732A39FA52177E8446FC0E5E91E1C00D6B9C270AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3534d60c-b9f3-4e9f-9094-7cb86074842f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3534d60c-b9f3-4e9f-9094-7cb86074842f.tmp
Size 9KB
SHA256 dc4439fb7c84683688ba774a01c71150dba3065f461f24f2caded297f3d6c303
MD5 5b59c529d770750a14d1cb44eb90a79c
SHA1 47689a8a9b98e7dd7f296ff06c4c138206675c80
SHA512 164976ab02abfaa86c16cd2f7a403146def6d760e217d8df995579bb1ef15be4dd670926105b99c9117debb858734f421065c5d2250594e2b562bbe4ce7ec145
SSDEEP 192:zMsNdC6nnHCUQmiUytMwcbcX5hQDP1yOO/HGFfE9ogyNuq5VLUO:zMsNdC6nikGzcQX5+DtyOO/Hq89GNlJX
TLSH
T13612F931A8A8FC378DE6A595F5C732A39FA52177E8446FC0E5D81E1C00D779C274AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

14d20b5a-851a-4979-b90c-b3836a7b5edc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\14d20b5a-851a-4979-b90c-b3836a7b5edc.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84639255-43eb-4936-87ec-b2ed0ec8c929.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\84639255-43eb-4936-87ec-b2ed0ec8c929.tmp
Size 26KB
SHA256 1cbda41b8e0ac179fa37b3e35bee30eb8542037ab7982e1adc3f5d180281d5e3
MD5 6c9c5784bf31e5fbbb6d68b21c7b5ef8
SHA1 ca3a642064511c55aad9d47ee943793bc5d2979d
SHA512 2e9778e6fb14bc89fd2ae04cfde52402c0b97d811b6d30d93109869d05a7af53ad8ba90d5e5c52e63909d20d95aabee9b23aa27a1dc2770253e5d25f54e6649b
SSDEEP 768:lqyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXOropD7rY:lqyYR7jWv3NpBu1ja/CL8OXF1Y
TLSH
T18EC2D82B640DCB7E4FC01E9DDC5A6F9B2E9802C7A6548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91ee14e9-dc63-4080-a91c-96ecfcc918e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91ee14e9-dc63-4080-a91c-96ecfcc918e4.tmp
Size 7KB
SHA256 be451712ef45825838dd728aa98014351fcf1dc8649dd08c9abfa558207c3088
MD5 b542a71e937661dda7105f8e7ccb5144
SHA1 14196057a1af5e57bc01f550450cb2bb02f39d31
SHA512 15487a710fb2cf2a475c99990731b28b33773f5e704456bd129934e8e7162054d7880bbca028a4702350706eedccc70a86deaf76dbe7ef9e2bb2a942c23679cc
SSDEEP 96:sa2j4OiEDWbR6QscgUb9SZkUdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjaiQ673X:sxVu/sFN3rpMHW6+WNGYob+rxhgF
TLSH
T140F1C752AE28797B8CCBE11DBA657B53E1F9512135C41A48ABFC9A1C089B6CD2307C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73c9817e-0e7a-452b-83c7-2a410ed84cb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\73c9817e-0e7a-452b-83c7-2a410ed84cb2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

97a81470-d2b1-47b6-9b13-bfe40401719f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\97a81470-d2b1-47b6-9b13-bfe40401719f.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

ecd23cc3-9ce1-4ffd-9a70-068fb7c1ca4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ecd23cc3-9ce1-4ffd-9a70-068fb7c1ca4a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b31d8448-b240-44e6-934b-3505f83d1c56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b31d8448-b240-44e6-934b-3505f83d1c56.tmp
Size 8KB
SHA256 6769e510d8e03d03a40677147397beac944b8bf1112600995483fe0ab6867047
MD5 5819b7c1a37ff65a0f5f5a5bf09a6c07
SHA1 d3c092e9b21ac6dff2bb7cb067a861143007606a
SHA512 7a52d31ad1512e50c86d4dd1bf4e46764e49c60f05094d357f86ac9d1059418fedf48b657993df1cda663ceaf9941f50d6fd7ab7b4a4def20b645b5cf2ebdbf4
SSDEEP 192:EONs6nnHGQmiUydbQYcX5hQDP1yOO/FMcMWU6:EONs6nCKQNX5+DtyOO/F3U6
TLSH
T11A02DA34BC687C778EF7AE49B58A27135FA5216BA5946BC0DAEC1E1C00D765C2306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpF6AF.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpF6AF.tmp.bat
Size 156B
SHA256 53f8c0c535ea0aa1c796ecbb6903f2f89e36d52027fb1650d8b8ff173fd2d4d4
MD5 d8ac6b3a3f10f32b0ed0f6fbef45738f
SHA1 e2e7bfec9460dd9ded576bd2d112757c8d3651d3
SHA512 a2d173dc24e25d88bbecb283241091f1a393c9b92605299c247425513b51523cbebdf5b02dbf98a95b457cb15f0538bf06bd4e19542df88b2aa1f6161105d4c5
TLSH
T18AC08C8295C5AA0E280D245326FAD8ACA1A668193F40AB108348446A1280489F09A242
MD5 SHA1 SHA512 TLSH

Submit Download

FL Studio 25.exe

Path C:\Users\Admin\AppData\Roaming\FL Studio 25.exe
Size 144KB
SHA256 f6aaeb3d9ea91538739ed36f5b8f53eac68b0050562e3f14019ad4ab8a9a7d53
MD5 2bdcc6d42079cd43ad269d2ad57b5ba9
SHA1 870f91a6765e694474adc64c41f396ea6a8d85dc
SHA512 5c46210d202505a8324dbe6bf9b27504884d92b9ddb928fe8522d359e362d828d40b4dc6e126f8418387a0739b21d89fe7f0c7e270d9eabb2dc4bb0a2706efa0
SSDEEP 3072:vuYqTsAvSX2DtiF3bc5rg8ZcETg3+vhjNZQfGZLDaTIOYWnj:vuY6vSGx83bEZtj7QfGZLuOi
TLSH
T1EEE38D0C2FD5471BD3597AF45DA3D355DC7FAE623102DB4A98803BBA1E22AC325035AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2532-3-0x00000000059E0000-0x0000000005A7C000-memory.dmp

Download

memory/2532-2-0x0000000005530000-0x0000000005596000-memory.dmp

Download

memory/2532-1-0x00000000055F0000-0x0000000005600000-memory.dmp

Download

memory/2532-0-0x0000000000B70000-0x0000000000B9A000-memory.dmp

Download