Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-04-2024 04:32

General

  • Target

    2809ff11620a7793560052c4a9c7f2b520b608f3d32c7722133cbeb60e5e9d70.exe

  • Size

    421KB

  • MD5

    11dcd8e017b0e067e922cfb6507a8dde

  • SHA1

    80c4e499c9666401a0f9099482c7fa9debe006d5

  • SHA256

    2809ff11620a7793560052c4a9c7f2b520b608f3d32c7722133cbeb60e5e9d70

  • SHA512

    52b3b17b4d589f9c8fa8dd6b97607b09b84f61cfc7031ac7b9c6f8e348a20f35785e602020e2c0808374f194226eb7bc41cc9d26e7ba37ca9454f54ed2d443f0

  • SSDEEP

    6144:CD9LLLaXO4MxL2D1i3VZUk2IzXd4wFNOC0JaNv8S3+FMgSx3U:CDRnsMSB+3U3IztPjzkS3Bpx

Malware Config

Extracted

Family

amadey

Version

4.18

Attributes
  • install_dir

    154561dcbf

  • install_file

    Dctooux.exe

  • strings_key

    2cd47fa043c815e1a033c67832f3c6a5

  • url_paths

    /j4Fvskd3/index.php

rc4.plain

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199673019888

https://t.me/irfail

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

94.228.162.82:6606

94.228.162.82:7707

94.228.162.82:8808

Mutex

YBc01FE5mcOd

Attributes
  • delay

    3

  • install

    true

  • install_file

    appBroker.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect Vidar Stealer 6 IoCs
  • Detect ZGRat V1 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 36 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2809ff11620a7793560052c4a9c7f2b520b608f3d32c7722133cbeb60e5e9d70.exe
    "C:\Users\Admin\AppData\Local\Temp\2809ff11620a7793560052c4a9c7f2b520b608f3d32c7722133cbeb60e5e9d70.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 744
      2⤵
      • Program crash
      PID:3188
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 804
      2⤵
      • Program crash
      PID:1232
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 860
      2⤵
      • Program crash
      PID:3820
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 896
      2⤵
      • Program crash
      PID:4032
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 896
      2⤵
      • Program crash
      PID:3004
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 952
      2⤵
      • Program crash
      PID:1928
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 1140
      2⤵
      • Program crash
      PID:3596
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 1160
      2⤵
      • Program crash
      PID:4756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 1240
      2⤵
      • Program crash
      PID:3916
    • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
      "C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 552
        3⤵
        • Program crash
        PID:2212
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 572
        3⤵
        • Program crash
        PID:4504
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 580
        3⤵
        • Program crash
        PID:3000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 720
        3⤵
        • Program crash
        PID:3956
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 888
        3⤵
        • Program crash
        PID:2984
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 888
        3⤵
        • Program crash
        PID:4948
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 620
        3⤵
        • Program crash
        PID:2332
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 888
        3⤵
        • Program crash
        PID:1628
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 724
        3⤵
        • Program crash
        PID:1664
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1020
        3⤵
        • Program crash
        PID:3728
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1152
        3⤵
        • Program crash
        PID:4716
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1312
        3⤵
        • Program crash
        PID:2928
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1408
        3⤵
        • Program crash
        PID:2444
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1672
        3⤵
        • Program crash
        PID:3140
      • C:\Users\Admin\AppData\Local\Temp\1000101001\vidar.exe
        "C:\Users\Admin\AppData\Local\Temp\1000101001\vidar.exe"
        3⤵
        • Executes dropped EXE
        PID:4012
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 2104
          4⤵
          • Program crash
          PID:2252
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1652
        3⤵
        • Program crash
        PID:3012
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000102011\build.dll, Main
        3⤵
        • Loads dropped DLL
        PID:4188
      • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
        "C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"
        3⤵
          PID:2372
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1772
          3⤵
          • Program crash
          PID:3556
        • C:\Users\Admin\AppData\Roaming\1000104100\vidar.exe
          "C:\Users\Admin\AppData\Roaming\1000104100\vidar.exe"
          3⤵
          • Executes dropped EXE
          PID:3384
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 2052
            4⤵
            • Program crash
            PID:4804
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1636
          3⤵
          • Program crash
          PID:1768
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\1000105010\build.dll, Main
          3⤵
          • Loads dropped DLL
          PID:2764
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1508
          3⤵
          • Program crash
          PID:968
        • C:\Users\Admin\AppData\Roaming\1000107000\AsyncClient.exe
          "C:\Users\Admin\AppData\Roaming\1000107000\AsyncClient.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4348
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "appBroker" /tr '"C:\Users\Admin\AppData\Roaming\appBroker.exe"' & exit
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3284
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "appBroker" /tr '"C:\Users\Admin\AppData\Roaming\appBroker.exe"'
              5⤵
              • Creates scheduled task(s)
              PID:3492
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4D9E.tmp.bat""
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2360
            • C:\Windows\SysWOW64\timeout.exe
              timeout 3
              5⤵
              • Delays execution with timeout.exe
              PID:2320
            • C:\Users\Admin\AppData\Roaming\appBroker.exe
              "C:\Users\Admin\AppData\Roaming\appBroker.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1144
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1420
          3⤵
          • Program crash
          PID:528
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1664
          3⤵
          • Program crash
          PID:3804
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1704
          3⤵
          • Program crash
          PID:1408
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2192
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main
            4⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1292
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              5⤵
                PID:2488
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\084619521222_Desktop.zip' -CompressionLevel Optimal
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4152
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 852
          2⤵
          • Program crash
          PID:3980
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 812
          2⤵
          • Program crash
          PID:1936
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4928 -ip 4928
        1⤵
          PID:3932
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4928 -ip 4928
          1⤵
            PID:4152
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4928 -ip 4928
            1⤵
              PID:1468
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4928 -ip 4928
              1⤵
                PID:1500
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4928 -ip 4928
                1⤵
                  PID:1292
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4928 -ip 4928
                  1⤵
                    PID:3840
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4928 -ip 4928
                    1⤵
                      PID:5040
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4928 -ip 4928
                      1⤵
                        PID:3212
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4928 -ip 4928
                        1⤵
                          PID:5072
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4928 -ip 4928
                          1⤵
                            PID:2736
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4928 -ip 4928
                            1⤵
                              PID:3420
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2408 -ip 2408
                              1⤵
                                PID:4884
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2408 -ip 2408
                                1⤵
                                  PID:3452
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2408 -ip 2408
                                  1⤵
                                    PID:2252
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2408 -ip 2408
                                    1⤵
                                      PID:864
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2408 -ip 2408
                                      1⤵
                                        PID:4052
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2408 -ip 2408
                                        1⤵
                                          PID:3628
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2408 -ip 2408
                                          1⤵
                                            PID:4740
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2408 -ip 2408
                                            1⤵
                                              PID:3948
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2408 -ip 2408
                                              1⤵
                                                PID:3932
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2408 -ip 2408
                                                1⤵
                                                  PID:3060
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2408 -ip 2408
                                                  1⤵
                                                    PID:1596
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2408 -ip 2408
                                                    1⤵
                                                      PID:3292
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2408 -ip 2408
                                                      1⤵
                                                        PID:4608
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2408 -ip 2408
                                                        1⤵
                                                          PID:3884
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2408 -ip 2408
                                                          1⤵
                                                            PID:2720
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4012 -ip 4012
                                                            1⤵
                                                              PID:4572
                                                            • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                                              C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                                              1⤵
                                                              • Executes dropped EXE
                                                              PID:3000
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 444
                                                                2⤵
                                                                • Program crash
                                                                PID:804
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3000 -ip 3000
                                                              1⤵
                                                                PID:3468
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2408 -ip 2408
                                                                1⤵
                                                                  PID:2376
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2408 -ip 2408
                                                                  1⤵
                                                                    PID:1092
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2408 -ip 2408
                                                                    1⤵
                                                                      PID:3680
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2408 -ip 2408
                                                                      1⤵
                                                                        PID:1324
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3384 -ip 3384
                                                                        1⤵
                                                                          PID:3396
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2408 -ip 2408
                                                                          1⤵
                                                                            PID:4496
                                                                          • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            PID:5044
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 448
                                                                              2⤵
                                                                              • Program crash
                                                                              PID:3828
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5044 -ip 5044
                                                                            1⤵
                                                                              PID:4960
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2408 -ip 2408
                                                                              1⤵
                                                                                PID:4464

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UWHIVHCX\76561199673019888[1].htm

                                                                                Filesize

                                                                                33KB

                                                                                MD5

                                                                                91743118bdf874eb686609a23dff2474

                                                                                SHA1

                                                                                e8c358db98fc54897d14e8f830b2febf521c6b54

                                                                                SHA256

                                                                                d6f29928c04e39d5c9fb69bdaf4fe9f79c521e77140e3c7565954bfb57f60b7c

                                                                                SHA512

                                                                                260dc393c39bc7ba587a76dbcce3a0d401014c88b0dc6c97e4aa9be9ba6159c16d8a7229eaad07a8ad0baf97c33ce081ea1b224ef31c1bc0e00f8ed85eaf13d2

                                                                              • C:\Users\Admin\AppData\Local\Temp\084619521222

                                                                                Filesize

                                                                                83KB

                                                                                MD5

                                                                                afe85149c9e70a1c571891de76ba8f22

                                                                                SHA1

                                                                                7f37756058e649f47f9b078c741a02df6c3a3ec6

                                                                                SHA256

                                                                                b18a909a9bc3c0e7f66d72fee4f3ee09b61fcc804d14461a691e956797c31446

                                                                                SHA512

                                                                                bf049ca4d7c9230d43ab85e6d25b02ae4d70b161ad383190c480eb21ec05459ff5f8d438c82444f878b74e364d9f06318928ff1397f3f6061f811fdad2026b35

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000101001\vidar.exe

                                                                                Filesize

                                                                                300KB

                                                                                MD5

                                                                                b099ea0b80ecf49caa0d7003e0c95071

                                                                                SHA1

                                                                                228a2aec5cf27fd0fca1f23161257f86bd8359ca

                                                                                SHA256

                                                                                810ea612d81f4c82b81696d55fc6b5c3778d48d9dafc59419b45e2a7aa8abd92

                                                                                SHA512

                                                                                539ecc374f1c65cac5ec624f9be31f2ed26f268316613630ba48c813b515455c299abdb593fab6ec0759f70a1a72fe42134257488a54c83c850396cc38236029

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000102011\build.dll

                                                                                Filesize

                                                                                243KB

                                                                                MD5

                                                                                37976db9d0e6f8bf9db5ae4b56006d9d

                                                                                SHA1

                                                                                dda3158d09c332c054d01fa08ad9824cb00c7d6a

                                                                                SHA256

                                                                                2570478de33fd8035affc8658600653e13961eb0e378c27cdd462fb5ca90c687

                                                                                SHA512

                                                                                fb09c0a37f72f6f7cec57660f386c0a4042070b2db247e7638c426c44aba39b5f2bd09bbe2baf5ad5973de405e1aa60cc2a4e964e33776c0f0f930b60469af47

                                                                              • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe

                                                                                Filesize

                                                                                421KB

                                                                                MD5

                                                                                11dcd8e017b0e067e922cfb6507a8dde

                                                                                SHA1

                                                                                80c4e499c9666401a0f9099482c7fa9debe006d5

                                                                                SHA256

                                                                                2809ff11620a7793560052c4a9c7f2b520b608f3d32c7722133cbeb60e5e9d70

                                                                                SHA512

                                                                                52b3b17b4d589f9c8fa8dd6b97607b09b84f61cfc7031ac7b9c6f8e348a20f35785e602020e2c0808374f194226eb7bc41cc9d26e7ba37ca9454f54ed2d443f0

                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_btwlepma.fd4.ps1

                                                                                Filesize

                                                                                60B

                                                                                MD5

                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                SHA1

                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                SHA256

                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                SHA512

                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                              • C:\Users\Admin\AppData\Local\Temp\tmp4D9E.tmp.bat

                                                                                Filesize

                                                                                153B

                                                                                MD5

                                                                                a07278971d6ba8fc3d4a320185f7e129

                                                                                SHA1

                                                                                284ff25c910d2c9830f7e4fa45137a01e1dd1f21

                                                                                SHA256

                                                                                570ad432376f7e4ca05c82d198b901fbe3e90388e4b7909c68a90c5491b89e18

                                                                                SHA512

                                                                                6a4774739c2aee27e8b5ae2275850937c1d7b29f35b7ac567ce1cc372aff172e9c178b92d946d4582f9b8f98b2ef23c117377d8482a8cd9104b2c50c23ef0b47

                                                                              • C:\Users\Admin\AppData\Roaming\1000107000\AsyncClient.exe

                                                                                Filesize

                                                                                48KB

                                                                                MD5

                                                                                7fd8581748cdf137023ef96f1286ce0f

                                                                                SHA1

                                                                                c640bcbbebbe62c2a58235d1e6f9ec7eeb99387a

                                                                                SHA256

                                                                                0b685b0d52d434ab8311127daa63ae5597f7948d5a73016a1f8211587040b9a6

                                                                                SHA512

                                                                                bd4c7c3f646e4685fc750f69ca5b9af6d542ee4d22db1b9ae3b379b659d415e3f9895bde81f40448f927662ede5cd87fe0f85234134b519c9aa7900f1b811282

                                                                              • C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll

                                                                                Filesize

                                                                                1.2MB

                                                                                MD5

                                                                                4876ee75ce2712147c41ff1277cd2d30

                                                                                SHA1

                                                                                3733dc92318f0c6b92cb201e49151686281acda6

                                                                                SHA256

                                                                                bbfba2d40f48c16a53b5806555c08aff1982c3fe4a77964963edbab9d7e672ed

                                                                                SHA512

                                                                                9bf25d4d0dfebd287b0c84abb64612b3db00a26b0217490b35925e77487d6c872632c936cedf1205c46ecbf9d4dfc9bc7600bee05afc550b30ae0d0964c5afe9

                                                                              • memory/1144-139-0x0000000006590000-0x0000000006606000-memory.dmp

                                                                                Filesize

                                                                                472KB

                                                                              • memory/1144-138-0x0000000005430000-0x0000000005496000-memory.dmp

                                                                                Filesize

                                                                                408KB

                                                                              • memory/1144-140-0x0000000006810000-0x00000000068AC000-memory.dmp

                                                                                Filesize

                                                                                624KB

                                                                              • memory/1144-137-0x00000000059E0000-0x0000000005F84000-memory.dmp

                                                                                Filesize

                                                                                5.6MB

                                                                              • memory/1144-146-0x0000000072F00000-0x00000000736B0000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/1144-145-0x0000000006B20000-0x0000000006B82000-memory.dmp

                                                                                Filesize

                                                                                392KB

                                                                              • memory/1144-143-0x00000000068F0000-0x00000000068FA000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                              • memory/1144-136-0x00000000050E0000-0x00000000050F0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/1144-142-0x00000000068B0000-0x00000000068F0000-memory.dmp

                                                                                Filesize

                                                                                256KB

                                                                              • memory/1144-141-0x0000000006560000-0x000000000657E000-memory.dmp

                                                                                Filesize

                                                                                120KB

                                                                              • memory/1144-148-0x00000000050E0000-0x00000000050F0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/1144-134-0x0000000072F00000-0x00000000736B0000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/2408-52-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                Filesize

                                                                                40.3MB

                                                                              • memory/2408-122-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                Filesize

                                                                                40.3MB

                                                                              • memory/2408-169-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                Filesize

                                                                                40.3MB

                                                                              • memory/2408-18-0x0000000002FF0000-0x00000000030F0000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                              • memory/2408-19-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                Filesize

                                                                                40.3MB

                                                                              • memory/2408-29-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                Filesize

                                                                                40.3MB

                                                                              • memory/2408-31-0x0000000002FF0000-0x00000000030F0000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                              • memory/2408-30-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                Filesize

                                                                                40.3MB

                                                                              • memory/3000-57-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                Filesize

                                                                                40.3MB

                                                                              • memory/3000-56-0x0000000002D30000-0x0000000002E30000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                              • memory/3000-58-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                Filesize

                                                                                40.3MB

                                                                              • memory/3384-121-0x0000000000400000-0x0000000002C2E000-memory.dmp

                                                                                Filesize

                                                                                40.2MB

                                                                              • memory/3384-87-0x0000000002F20000-0x0000000003020000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                              • memory/3384-89-0x0000000000400000-0x0000000002C2E000-memory.dmp

                                                                                Filesize

                                                                                40.2MB

                                                                              • memory/4012-49-0x0000000002EF0000-0x0000000002F25000-memory.dmp

                                                                                Filesize

                                                                                212KB

                                                                              • memory/4012-53-0x0000000000400000-0x0000000002C2E000-memory.dmp

                                                                                Filesize

                                                                                40.2MB

                                                                              • memory/4012-48-0x0000000002D20000-0x0000000002E20000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                              • memory/4012-50-0x0000000000400000-0x0000000002C2E000-memory.dmp

                                                                                Filesize

                                                                                40.2MB

                                                                              • memory/4152-181-0x0000024E7EDD0000-0x0000024E7EDE0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4152-175-0x0000024E7E7B0000-0x0000024E7E7D2000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                              • memory/4152-191-0x00007FFCDA350000-0x00007FFCDAE11000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/4152-185-0x0000024E7CFB0000-0x0000024E7CFBA000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                              • memory/4152-184-0x0000024E7CFD0000-0x0000024E7CFE2000-memory.dmp

                                                                                Filesize

                                                                                72KB

                                                                              • memory/4152-183-0x0000024E7EDD0000-0x0000024E7EDE0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4152-182-0x0000024E7EDD0000-0x0000024E7EDE0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4152-180-0x00007FFCDA350000-0x00007FFCDAE11000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/4348-120-0x0000000071C80000-0x0000000072430000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/4348-123-0x0000000005260000-0x0000000005270000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4348-124-0x0000000005180000-0x000000000521C000-memory.dmp

                                                                                Filesize

                                                                                624KB

                                                                              • memory/4348-119-0x00000000007C0000-0x00000000007D2000-memory.dmp

                                                                                Filesize

                                                                                72KB

                                                                              • memory/4348-129-0x0000000071C80000-0x0000000072430000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/4928-17-0x0000000002DA0000-0x0000000002E0F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/4928-2-0x0000000002DA0000-0x0000000002E0F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/4928-3-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                Filesize

                                                                                40.3MB

                                                                              • memory/4928-16-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                Filesize

                                                                                40.3MB

                                                                              • memory/4928-1-0x0000000002FA0000-0x00000000030A0000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                              • memory/5044-154-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                Filesize

                                                                                40.3MB

                                                                              • memory/5044-153-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                Filesize

                                                                                40.3MB

                                                                              • memory/5044-152-0x0000000002F80000-0x0000000003080000-memory.dmp

                                                                                Filesize

                                                                                1024KB