Analysis

  • max time kernel
    152s
  • max time network
    161s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-04-2024 04:32

General

  • Target

    2809ff11620a7793560052c4a9c7f2b520b608f3d32c7722133cbeb60e5e9d70.exe

  • Size

    421KB

  • MD5

    11dcd8e017b0e067e922cfb6507a8dde

  • SHA1

    80c4e499c9666401a0f9099482c7fa9debe006d5

  • SHA256

    2809ff11620a7793560052c4a9c7f2b520b608f3d32c7722133cbeb60e5e9d70

  • SHA512

    52b3b17b4d589f9c8fa8dd6b97607b09b84f61cfc7031ac7b9c6f8e348a20f35785e602020e2c0808374f194226eb7bc41cc9d26e7ba37ca9454f54ed2d443f0

  • SSDEEP

    6144:CD9LLLaXO4MxL2D1i3VZUk2IzXd4wFNOC0JaNv8S3+FMgSx3U:CDRnsMSB+3U3IztPjzkS3Bpx

Malware Config

Extracted

Family

amadey

Version

4.18

Attributes
  • install_dir

    154561dcbf

  • install_file

    Dctooux.exe

  • strings_key

    2cd47fa043c815e1a033c67832f3c6a5

  • url_paths

    /j4Fvskd3/index.php

rc4.plain

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199673019888

https://t.me/irfail

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

94.228.162.82:6606

94.228.162.82:7707

94.228.162.82:8808

Mutex

YBc01FE5mcOd

Attributes
  • delay

    3

  • install

    true

  • install_file

    appBroker.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect Vidar Stealer 4 IoCs
  • Detect ZGRat V1 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 37 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2809ff11620a7793560052c4a9c7f2b520b608f3d32c7722133cbeb60e5e9d70.exe
    "C:\Users\Admin\AppData\Local\Temp\2809ff11620a7793560052c4a9c7f2b520b608f3d32c7722133cbeb60e5e9d70.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 772
      2⤵
      • Program crash
      PID:2012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 820
      2⤵
      • Program crash
      PID:2768
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 876
      2⤵
      • Program crash
      PID:4492
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 884
      2⤵
      • Program crash
      PID:2324
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 948
      2⤵
      • Program crash
      PID:4684
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 948
      2⤵
      • Program crash
      PID:4820
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 1016
      2⤵
      • Program crash
      PID:2264
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 1044
      2⤵
      • Program crash
      PID:1836
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 1032
      2⤵
      • Program crash
      PID:2740
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 1116
      2⤵
      • Program crash
      PID:4348
    • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
      "C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4396
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 580
        3⤵
        • Program crash
        PID:4544
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 624
        3⤵
        • Program crash
        PID:676
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 644
        3⤵
        • Program crash
        PID:1648
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 864
        3⤵
        • Program crash
        PID:3192
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 864
        3⤵
        • Program crash
        PID:3464
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 896
        3⤵
        • Program crash
        PID:3856
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 912
        3⤵
        • Program crash
        PID:3744
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 932
        3⤵
        • Program crash
        PID:2920
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 860
        3⤵
        • Program crash
        PID:4496
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1036
        3⤵
        • Program crash
        PID:2500
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1168
        3⤵
        • Program crash
        PID:2604
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1168
        3⤵
        • Program crash
        PID:3844
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1268
        3⤵
        • Program crash
        PID:1568
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1136
        3⤵
        • Program crash
        PID:1876
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1768
        3⤵
        • Program crash
        PID:2324
      • C:\Users\Admin\AppData\Local\Temp\1000101001\vidar.exe
        "C:\Users\Admin\AppData\Local\Temp\1000101001\vidar.exe"
        3⤵
        • Executes dropped EXE
        PID:4684
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 2156
          4⤵
          • Program crash
          PID:2860
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1740
        3⤵
        • Program crash
        PID:924
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000102011\build.dll, Main
        3⤵
        • Loads dropped DLL
        PID:2696
      • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
        "C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"
        3⤵
          PID:4928
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1592
          3⤵
          • Program crash
          PID:4008
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\1000105010\build.dll, Main
          3⤵
          • Loads dropped DLL
          PID:2812
        • C:\Users\Admin\AppData\Roaming\1000107000\AsyncClient.exe
          "C:\Users\Admin\AppData\Roaming\1000107000\AsyncClient.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1972
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "appBroker" /tr '"C:\Users\Admin\AppData\Roaming\appBroker.exe"' & exit
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3032
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "appBroker" /tr '"C:\Users\Admin\AppData\Roaming\appBroker.exe"'
              5⤵
              • Creates scheduled task(s)
              PID:2000
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE2E9.tmp.bat""
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4656
            • C:\Windows\SysWOW64\timeout.exe
              timeout 3
              5⤵
              • Delays execution with timeout.exe
              PID:1860
            • C:\Users\Admin\AppData\Roaming\appBroker.exe
              "C:\Users\Admin\AppData\Roaming\appBroker.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1940
          3⤵
          • Program crash
          PID:4948
        • C:\Users\Admin\AppData\Roaming\1000107000\AsyncClient.exe
          "C:\Users\Admin\AppData\Roaming\1000107000\AsyncClient.exe"
          3⤵
          • Executes dropped EXE
          PID:1852
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1888
          3⤵
          • Program crash
          PID:3096
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1720
          3⤵
          • Program crash
          PID:3008
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1792
          3⤵
          • Program crash
          PID:4868
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1916
          3⤵
          • Program crash
          PID:2324
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:3692
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main
            4⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2368
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              5⤵
                PID:1212
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\258603162493_Desktop.zip' -CompressionLevel Optimal
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3496
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 1176
          2⤵
          • Program crash
          PID:4896
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 436 -ip 436
        1⤵
          PID:4980
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 436 -ip 436
          1⤵
            PID:4336
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 436 -ip 436
            1⤵
              PID:876
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 436 -ip 436
              1⤵
                PID:4076
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 436 -ip 436
                1⤵
                  PID:4536
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 436 -ip 436
                  1⤵
                    PID:3080
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 436 -ip 436
                    1⤵
                      PID:1628
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 436 -ip 436
                      1⤵
                        PID:2360
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 436 -ip 436
                        1⤵
                          PID:1232
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 436 -ip 436
                          1⤵
                            PID:3268
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 436 -ip 436
                            1⤵
                              PID:2004
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4396 -ip 4396
                              1⤵
                                PID:4908
                              • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                1⤵
                                • Executes dropped EXE
                                PID:4612
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 472
                                  2⤵
                                  • Program crash
                                  PID:4176
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4396 -ip 4396
                                1⤵
                                  PID:4960
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4396 -ip 4396
                                  1⤵
                                    PID:4696
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4396 -ip 4396
                                    1⤵
                                      PID:1088
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4612 -ip 4612
                                      1⤵
                                        PID:5028
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4396 -ip 4396
                                        1⤵
                                          PID:1980
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4396 -ip 4396
                                          1⤵
                                            PID:3008
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4396 -ip 4396
                                            1⤵
                                              PID:448
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4396 -ip 4396
                                              1⤵
                                                PID:3304
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4396 -ip 4396
                                                1⤵
                                                  PID:1708
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4396 -ip 4396
                                                  1⤵
                                                    PID:2236
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4396 -ip 4396
                                                    1⤵
                                                      PID:3088
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4396 -ip 4396
                                                      1⤵
                                                        PID:3668
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4396 -ip 4396
                                                        1⤵
                                                          PID:2544
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4396 -ip 4396
                                                          1⤵
                                                            PID:2504
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4396 -ip 4396
                                                            1⤵
                                                              PID:2144
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4396 -ip 4396
                                                              1⤵
                                                                PID:3080
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4684 -ip 4684
                                                                1⤵
                                                                  PID:2844
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4396 -ip 4396
                                                                  1⤵
                                                                    PID:2520
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4396 -ip 4396
                                                                    1⤵
                                                                      PID:3012
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4396 -ip 4396
                                                                      1⤵
                                                                        PID:3760
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4396 -ip 4396
                                                                        1⤵
                                                                          PID:3364
                                                                        • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          PID:4516
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 476
                                                                            2⤵
                                                                            • Program crash
                                                                            PID:5076
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4516 -ip 4516
                                                                          1⤵
                                                                            PID:4528
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4396 -ip 4396
                                                                            1⤵
                                                                              PID:4356
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4396 -ip 4396
                                                                              1⤵
                                                                                PID:4536
                                                                              • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                PID:4264
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 476
                                                                                  2⤵
                                                                                  • Program crash
                                                                                  PID:1336
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4264 -ip 4264
                                                                                1⤵
                                                                                  PID:2056

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AsyncClient.exe.log

                                                                                  Filesize

                                                                                  425B

                                                                                  MD5

                                                                                  bb27934be8860266d478c13f2d65f45e

                                                                                  SHA1

                                                                                  a69a0e171864dcac9ade1b04fc0313e6b4024ccb

                                                                                  SHA256

                                                                                  85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4

                                                                                  SHA512

                                                                                  87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb

                                                                                • C:\Users\Admin\AppData\Local\Temp\1000101001\vidar.exe

                                                                                  Filesize

                                                                                  300KB

                                                                                  MD5

                                                                                  b099ea0b80ecf49caa0d7003e0c95071

                                                                                  SHA1

                                                                                  228a2aec5cf27fd0fca1f23161257f86bd8359ca

                                                                                  SHA256

                                                                                  810ea612d81f4c82b81696d55fc6b5c3778d48d9dafc59419b45e2a7aa8abd92

                                                                                  SHA512

                                                                                  539ecc374f1c65cac5ec624f9be31f2ed26f268316613630ba48c813b515455c299abdb593fab6ec0759f70a1a72fe42134257488a54c83c850396cc38236029

                                                                                • C:\Users\Admin\AppData\Local\Temp\1000102011\build.dll

                                                                                  Filesize

                                                                                  243KB

                                                                                  MD5

                                                                                  37976db9d0e6f8bf9db5ae4b56006d9d

                                                                                  SHA1

                                                                                  dda3158d09c332c054d01fa08ad9824cb00c7d6a

                                                                                  SHA256

                                                                                  2570478de33fd8035affc8658600653e13961eb0e378c27cdd462fb5ca90c687

                                                                                  SHA512

                                                                                  fb09c0a37f72f6f7cec57660f386c0a4042070b2db247e7638c426c44aba39b5f2bd09bbe2baf5ad5973de405e1aa60cc2a4e964e33776c0f0f930b60469af47

                                                                                • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe

                                                                                  Filesize

                                                                                  421KB

                                                                                  MD5

                                                                                  11dcd8e017b0e067e922cfb6507a8dde

                                                                                  SHA1

                                                                                  80c4e499c9666401a0f9099482c7fa9debe006d5

                                                                                  SHA256

                                                                                  2809ff11620a7793560052c4a9c7f2b520b608f3d32c7722133cbeb60e5e9d70

                                                                                  SHA512

                                                                                  52b3b17b4d589f9c8fa8dd6b97607b09b84f61cfc7031ac7b9c6f8e348a20f35785e602020e2c0808374f194226eb7bc41cc9d26e7ba37ca9454f54ed2d443f0

                                                                                • C:\Users\Admin\AppData\Local\Temp\258603162493

                                                                                  Filesize

                                                                                  82KB

                                                                                  MD5

                                                                                  7d74fd00faa07ab82bf844e66f8adfeb

                                                                                  SHA1

                                                                                  8076a9f3e766f2b1d01f53ea7fa20363ac115775

                                                                                  SHA256

                                                                                  eca62539e9f14cd9e31568694b697a76676a132a1c43b9f9e0cd76853238d1de

                                                                                  SHA512

                                                                                  3ebb204e3d03443f3fd6ed28ce627e3a48da9b37e0ff61f59c2f3cbb97d30d6c9765df197b1876ce0b4a9ebf92c34d0e1e2f73f6a864102092ffaa6d5dbc96ff

                                                                                • C:\Users\Admin\AppData\Local\Temp\258603162493_Desktop.zip

                                                                                  Filesize

                                                                                  160KB

                                                                                  MD5

                                                                                  888109621445b833b7a421884fa630d2

                                                                                  SHA1

                                                                                  14aded356b697a143e35099467cc4f283672fd09

                                                                                  SHA256

                                                                                  88d0a3a21ad28a90e082a4cb3874006c0fcc35ab07476c802ecc63ff8117a1a0

                                                                                  SHA512

                                                                                  0736eefc0aaa440b3c6619f55f94d5e9eeb9fb8cb379cd1fbfa31fcb27558acb22c44b8427219a943ced3c6da9635a27bdb509339e0bb59ddf58119f5cd8cd99

                                                                                • C:\Users\Admin\AppData\Local\Temp\_Files_\SyncPing.xls

                                                                                  Filesize

                                                                                  160KB

                                                                                  MD5

                                                                                  6bcbcbd38a160f31a983baf685317119

                                                                                  SHA1

                                                                                  bdcd302c4a9b2f498a210b33c5289352d10135bc

                                                                                  SHA256

                                                                                  b7412915875632d11fefc9271a7a2c95a1e130d84886d057f02d2b44f5106132

                                                                                  SHA512

                                                                                  9fc1ff8e677078b888cc26a1801bb3969b337931ce1ee3381a41cd2411fff053fdd66a1717b0eefdc94729bceac91279089d17cfe5bfe75f859c7aa214d4cca3

                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iazfxq2n.alv.ps1

                                                                                  Filesize

                                                                                  60B

                                                                                  MD5

                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                  SHA1

                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                  SHA256

                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                  SHA512

                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpE2E9.tmp.bat

                                                                                  Filesize

                                                                                  153B

                                                                                  MD5

                                                                                  82550e030f42f5e7bacb54af59cedb52

                                                                                  SHA1

                                                                                  3eaa16bbf3c4207411d88869b0ed46b81f278642

                                                                                  SHA256

                                                                                  e23fe0fc8594dbec0849207a8370adc2bb924ec6cac83c01de019dba46db1d90

                                                                                  SHA512

                                                                                  0d76afe564417ef4314b983036fee5801b2f5246c4db95c4e164ee7d7d8178cb10567e934dc765c5d8ace04632b9fb0dd90e39de977a020396ff2c4f5292e60e

                                                                                • C:\Users\Admin\AppData\Roaming\1000107000\AsyncClient.exe

                                                                                  Filesize

                                                                                  48KB

                                                                                  MD5

                                                                                  7fd8581748cdf137023ef96f1286ce0f

                                                                                  SHA1

                                                                                  c640bcbbebbe62c2a58235d1e6f9ec7eeb99387a

                                                                                  SHA256

                                                                                  0b685b0d52d434ab8311127daa63ae5597f7948d5a73016a1f8211587040b9a6

                                                                                  SHA512

                                                                                  bd4c7c3f646e4685fc750f69ca5b9af6d542ee4d22db1b9ae3b379b659d415e3f9895bde81f40448f927662ede5cd87fe0f85234134b519c9aa7900f1b811282

                                                                                • C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll

                                                                                  Filesize

                                                                                  1.2MB

                                                                                  MD5

                                                                                  4876ee75ce2712147c41ff1277cd2d30

                                                                                  SHA1

                                                                                  3733dc92318f0c6b92cb201e49151686281acda6

                                                                                  SHA256

                                                                                  bbfba2d40f48c16a53b5806555c08aff1982c3fe4a77964963edbab9d7e672ed

                                                                                  SHA512

                                                                                  9bf25d4d0dfebd287b0c84abb64612b3db00a26b0217490b35925e77487d6c872632c936cedf1205c46ecbf9d4dfc9bc7600bee05afc550b30ae0d0964c5afe9

                                                                                • memory/436-17-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/436-2-0x0000000004AF0000-0x0000000004B5F000-memory.dmp

                                                                                  Filesize

                                                                                  444KB

                                                                                • memory/436-1-0x0000000002CE0000-0x0000000002DE0000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                • memory/436-3-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/436-18-0x0000000004AF0000-0x0000000004B5F000-memory.dmp

                                                                                  Filesize

                                                                                  444KB

                                                                                • memory/436-5-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/1852-116-0x0000000071770000-0x0000000071F21000-memory.dmp

                                                                                  Filesize

                                                                                  7.7MB

                                                                                • memory/1852-124-0x00000000052E0000-0x00000000052F0000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/1852-127-0x0000000071770000-0x0000000071F21000-memory.dmp

                                                                                  Filesize

                                                                                  7.7MB

                                                                                • memory/1972-122-0x00000000057E0000-0x000000000587C000-memory.dmp

                                                                                  Filesize

                                                                                  624KB

                                                                                • memory/1972-114-0x0000000071770000-0x0000000071F21000-memory.dmp

                                                                                  Filesize

                                                                                  7.7MB

                                                                                • memory/1972-113-0x00000000009B0000-0x00000000009C2000-memory.dmp

                                                                                  Filesize

                                                                                  72KB

                                                                                • memory/1972-119-0x0000000005430000-0x0000000005440000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/1972-132-0x0000000071770000-0x0000000071F21000-memory.dmp

                                                                                  Filesize

                                                                                  7.7MB

                                                                                • memory/3088-149-0x0000000006A70000-0x0000000006AD2000-memory.dmp

                                                                                  Filesize

                                                                                  392KB

                                                                                • memory/3088-137-0x00000000724B0000-0x0000000072C61000-memory.dmp

                                                                                  Filesize

                                                                                  7.7MB

                                                                                • memory/3088-144-0x0000000006630000-0x000000000664E000-memory.dmp

                                                                                  Filesize

                                                                                  120KB

                                                                                • memory/3088-143-0x0000000006700000-0x000000000679C000-memory.dmp

                                                                                  Filesize

                                                                                  624KB

                                                                                • memory/3088-142-0x0000000006680000-0x00000000066F6000-memory.dmp

                                                                                  Filesize

                                                                                  472KB

                                                                                • memory/3088-151-0x0000000004F00000-0x0000000004F10000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/3088-141-0x0000000005310000-0x0000000005376000-memory.dmp

                                                                                  Filesize

                                                                                  408KB

                                                                                • memory/3088-150-0x00000000724B0000-0x0000000072C61000-memory.dmp

                                                                                  Filesize

                                                                                  7.7MB

                                                                                • memory/3088-145-0x0000000006800000-0x0000000006840000-memory.dmp

                                                                                  Filesize

                                                                                  256KB

                                                                                • memory/3088-140-0x0000000005850000-0x0000000005DF6000-memory.dmp

                                                                                  Filesize

                                                                                  5.6MB

                                                                                • memory/3088-146-0x0000000006660000-0x000000000666A000-memory.dmp

                                                                                  Filesize

                                                                                  40KB

                                                                                • memory/3088-139-0x0000000004F00000-0x0000000004F10000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/3496-178-0x000001CC4BDD0000-0x000001CC4BDE0000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/3496-186-0x00007FFBBF6C0000-0x00007FFBC0182000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                • memory/3496-180-0x000001CC65BF0000-0x000001CC65BFA000-memory.dmp

                                                                                  Filesize

                                                                                  40KB

                                                                                • memory/3496-179-0x000001CC65C10000-0x000001CC65C22000-memory.dmp

                                                                                  Filesize

                                                                                  72KB

                                                                                • memory/3496-166-0x00007FFBBF6C0000-0x00007FFBC0182000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                • memory/3496-177-0x000001CC65B80000-0x000001CC65BA2000-memory.dmp

                                                                                  Filesize

                                                                                  136KB

                                                                                • memory/3496-168-0x000001CC4BDD0000-0x000001CC4BDE0000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/3496-167-0x000001CC4BDD0000-0x000001CC4BDE0000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/4264-190-0x0000000002F80000-0x0000000003080000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                • memory/4264-191-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4396-38-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4396-57-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4396-27-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4396-121-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4396-31-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4396-37-0x0000000002DE0000-0x0000000002EE0000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                • memory/4396-164-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4396-19-0x0000000002DE0000-0x0000000002EE0000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                • memory/4396-20-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4396-39-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4516-125-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4516-120-0x0000000002E00000-0x0000000002F00000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                • memory/4516-123-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4612-24-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4612-23-0x0000000002EF0000-0x0000000002FF0000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                • memory/4612-25-0x0000000000400000-0x0000000002C4C000-memory.dmp

                                                                                  Filesize

                                                                                  40.3MB

                                                                                • memory/4684-64-0x0000000000400000-0x0000000002C2E000-memory.dmp

                                                                                  Filesize

                                                                                  40.2MB

                                                                                • memory/4684-58-0x0000000002E60000-0x0000000002F60000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                • memory/4684-59-0x00000000030A0000-0x00000000030D5000-memory.dmp

                                                                                  Filesize

                                                                                  212KB

                                                                                • memory/4684-60-0x0000000000400000-0x0000000002C2E000-memory.dmp

                                                                                  Filesize

                                                                                  40.2MB