Overview

overview

10

Static

static

3

RebelCracked.exe

windows7-x64

10

RebelCracked.exe

windows10-2004-x64

10

Resubmissions

01-10-2024 19:23

241001-x3tkyszekh 10

01-10-2024 19:14

241001-xxtc1awdmj 10

30-09-2024 22:07

240930-11v8jsxdnm 10

30-09-2024 21:59

240930-1wfmas1crg 10

30-09-2024 20:26

240930-y8bg1atepl 10

26-09-2024 20:34

240926-zcgvkszbmg 10

26-09-2024 19:28

240926-x6rkrstfrr 10

26-09-2024 19:21

240926-x2mq1swhnh 10

26-09-2024 19:20

240926-x19jdstdpl 10

25-09-2024 21:15

240925-z4dx1a1elf 10

Analysis

  • max time kernel
    19s
  • max time network
    25s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-09-2024 20:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RebelCracked.exe

  • Size

    344KB

  • MD5

    a84fd0fc75b9c761e9b7923a08da41c7

  • SHA1

    2597048612041cd7a8c95002c73e9c2818bb2097

  • SHA256

    9d9a79f4ae9bf7a992945f6c06c5bec642c05e4e828217c50255dabfa3677006

  • SHA512

    a17f1144a0e3ce07c7ed6891987c5b969f291e9991442c33750028d35e2194794e8a649c397e8afc9f8ce19d485c453600c75cab4fcead09e38414d85819251a

  • SSDEEP

    6144:lOcpeK8lucxAtLNFHUVuI/2zj1z6jZ755NofmWx4PCQL23wBw7R0ljTwrVuAdJKp:QcpSnx0LNFDQ60Ntbo5d7gBw7R7rbdJk

Score
10/10
asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 5 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 26 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 8 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 9 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
    "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2848
      • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        3⤵
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2904
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:1800
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            5⤵
            • System Location Discovery: System Language Discovery
            PID:636
          • C:\Windows\SysWOW64\netsh.exe
            netsh wlan show profile
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:2284
          • C:\Windows\SysWOW64\findstr.exe
            findstr All
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1416
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2436
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            5⤵
            • System Location Discovery: System Language Discovery
            PID:336
          • C:\Windows\SysWOW64\netsh.exe
            netsh wlan show networks mode=bssid
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1660
    • C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
      "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1660
        • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
          "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
          4⤵
            PID:988
          • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
            "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
            4⤵
            • Executes dropped EXE
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1424
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
              5⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:2316
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1680
              • C:\Windows\SysWOW64\netsh.exe
                netsh wlan show profile
                6⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Wi-Fi Discovery
                PID:2332
              • C:\Windows\SysWOW64\findstr.exe
                findstr All
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1808
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2708
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2704
              • C:\Windows\SysWOW64\netsh.exe
                netsh wlan show networks mode=bssid
                6⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:2680
        • C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
          "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2616
          • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
            "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2432
            • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
              "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
              5⤵
              • Executes dropped EXE
              • Drops desktop.ini file(s)
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2820
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                6⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Wi-Fi Discovery
                PID:2268
                • C:\Windows\SysWOW64\chcp.com
                  chcp 65001
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:2184
                • C:\Windows\SysWOW64\netsh.exe
                  netsh wlan show profile
                  7⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Wi-Fi Discovery
                  PID:1660
                • C:\Windows\SysWOW64\findstr.exe
                  findstr All
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1200
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1684
                • C:\Windows\SysWOW64\chcp.com
                  chcp 65001
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1804
                • C:\Windows\SysWOW64\netsh.exe
                  netsh wlan show networks mode=bssid
                  7⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:1484
          • C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
            "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2148
            • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
              "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1572
              • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                6⤵
                • Executes dropped EXE
                • Drops desktop.ini file(s)
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1740
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Wi-Fi Discovery
                  PID:2104
                  • C:\Windows\SysWOW64\chcp.com
                    chcp 65001
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1720
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh wlan show profile
                    8⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:2556
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr All
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2088
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1372
                  • C:\Windows\SysWOW64\chcp.com
                    chcp 65001
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1932
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh wlan show networks mode=bssid
                    8⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:2000
            • C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
              "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
              5⤵
                PID:1760
                • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                  "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:1808
                  • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                    "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                    7⤵
                      PID:572
                    • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                      "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                      7⤵
                        PID:2496
                      • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                        7⤵
                        • Executes dropped EXE
                        • Drops desktop.ini file(s)
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2944
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                          8⤵
                          • System Network Configuration Discovery: Wi-Fi Discovery
                          PID:1148
                    • C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
                      "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
                      6⤵
                        PID:832
                        • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                          "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:2664
                          • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                            "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                            8⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2212
                        • C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
                          "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
                          7⤵
                            PID:2960
                            • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                              "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              PID:1632
                              • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                                "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                                9⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:596
                            • C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
                              "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
                              8⤵
                                PID:2728
                                • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                                  "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                                  9⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  PID:2972
                                  • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                                    "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                                    10⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2056
                                • C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
                                  "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
                                  9⤵
                                    PID:2252
                                    • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                                      "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                                      10⤵
                                        PID:964
                                        • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                                          "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
                                          11⤵
                                            PID:1536
                                        • C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
                                          "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
                                          10⤵
                                            PID:1672

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\0ee64e7d9a23a8545451f681e806e104\msgid.dat
                          Filesize

                          1B

                          MD5

                          cfcd208495d565ef66e7dff9f98764da

                          SHA1

                          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                          SHA256

                          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                          SHA512

                          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Browsers\Firefox\Bookmarks.txt
                          Filesize

                          105B

                          MD5

                          2e9d094dda5cdc3ce6519f75943a4ff4

                          SHA1

                          5d989b4ac8b699781681fe75ed9ef98191a5096c

                          SHA256

                          c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                          SHA512

                          d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Desktop.txt
                          Filesize

                          529B

                          MD5

                          6f6e0fc9fedce8697713a6aa14a8436c

                          SHA1

                          bbbe9c02c459b51c6a7c6a686891aba0c683e111

                          SHA256

                          e3ba6c14ad8f1e164e508f60e5ed7e1c754acf728ac3e4842336a8d10485a7bc

                          SHA512

                          8fe0771d546d124fecd1ce00ae358afa1a8a4874cfd6b04a1f5508dd5fea53c01b5df282177c67541b621ae48e7d31849b23ad7f34b28be7821f1a6d53ebdefa

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Documents.txt
                          Filesize

                          650B

                          MD5

                          4baf19fcd435da8d338d24764590f436

                          SHA1

                          c05a5343fe7f96e2d908e8436be4ce94b1a2eca4

                          SHA256

                          16793007724acffe9708c5ccfa81b68d9f98cbb3ab341fd6eec6c4238b7f4e76

                          SHA512

                          ae354d740c91d52ca6e4ae894f4ddd7804158c300b18d7950d028dec3e9df1b87d829a26606499616e3e4098f2081d7459a2510bb1853ed62cf95e11417fff87

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Downloads.txt
                          Filesize

                          722B

                          MD5

                          868ae0d35aaef9de35a2b4e2ca33683a

                          SHA1

                          f59032206e70a33bdc12ead57a0130df479b7707

                          SHA256

                          c9109a6800f643d4ff66dcc1ba06f05a2d1ac669bb313dcc3e2855fa24f6f488

                          SHA512

                          ada102de607a765e56de27d430dda826b1874161aacf59a2e04d5d2a1813be28fbc5315ec09e729cd6fa822defd914a0f071340f5964d49d88ce07bb3bccb2e2

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Pictures.txt
                          Filesize

                          719B

                          MD5

                          77326c9e7599d9c3d8679d3d887ca8d7

                          SHA1

                          1731657e370ac322e6b3218efc7ce96661f95c8d

                          SHA256

                          7a88a3a64ed1bc64a9335535f3d61e5264dfd8f312740b691972fd90abee5709

                          SHA512

                          a47c41c631efc46ba6dfc568267063508239c4b2aa309a7350858fb045e05b6e446cd928002868d83c4e0bf4ff7c35935b353a987284635a5a5d2806b61202bc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Startup.txt
                          Filesize

                          24B

                          MD5

                          68c93da4981d591704cea7b71cebfb97

                          SHA1

                          fd0f8d97463cd33892cc828b4ad04e03fc014fa6

                          SHA256

                          889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

                          SHA512

                          63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Temp.txt
                          Filesize

                          2KB

                          MD5

                          11da0ed48136bb264bcdf0c0ef4ecce1

                          SHA1

                          78b134e379df9dfebac99c8a221efdc3a1582d6b

                          SHA256

                          fedeb4891bb749272c6806bdb29a1c8f64e2a0c6abd9daab1b07402351767a50

                          SHA512

                          708f579b5f5a8609b7dcea8607e55d13af859bf9d56de41e06b4fe912d621f08de594badc6b93419711db4cbc25791ac685f2c24e3ccfd8c37b563f4b2becb2c

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Videos.txt
                          Filesize

                          23B

                          MD5

                          1fddbf1169b6c75898b86e7e24bc7c1f

                          SHA1

                          d2091060cb5191ff70eb99c0088c182e80c20f8c

                          SHA256

                          a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

                          SHA512

                          20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini
                          Filesize

                          282B

                          MD5

                          9e36cc3537ee9ee1e3b10fa4e761045b

                          SHA1

                          7726f55012e1e26cc762c9982e7c6c54ca7bb303

                          SHA256

                          4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026

                          SHA512

                          5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini
                          Filesize

                          402B

                          MD5

                          ecf88f261853fe08d58e2e903220da14

                          SHA1

                          f72807a9e081906654ae196605e681d5938a2e6c

                          SHA256

                          cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844

                          SHA512

                          82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini
                          Filesize

                          282B

                          MD5

                          3a37312509712d4e12d27240137ff377

                          SHA1

                          30ced927e23b584725cf16351394175a6d2a9577

                          SHA256

                          b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3

                          SHA512

                          dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini
                          Filesize

                          504B

                          MD5

                          29eae335b77f438e05594d86a6ca22ff

                          SHA1

                          d62ccc830c249de6b6532381b4c16a5f17f95d89

                          SHA256

                          88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4

                          SHA512

                          5d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt
                          Filesize

                          62B

                          MD5

                          9a2d2d7054a7ae9a476ac69345b3ba1b

                          SHA1

                          1d06a9295a0f7f56e596cc69efcbc3ff72fbe737

                          SHA256

                          4a68c1976a4c217b9097ab19c3352602df9f1db48908dcba108bca5befbc5121

                          SHA512

                          afa1f46a538231b5ebd5d4679a685b9f0f1d3c67b92925f20cb8584bc8f90a42d58100b2841c0ebade54e2201594a534a9f64f6b4a3a1d9942c18ae1f93c1b28

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt
                          Filesize

                          133B

                          MD5

                          9b8cf6ad60da4c5e7ecb494e859882fe

                          SHA1

                          eda362163f2b1d0706bc364ddbac7fb844d90a81

                          SHA256

                          52b15f078c4ae6f3100697462c4ba8b3c6c1bb648dc45c5f76b864fdb58f25ae

                          SHA512

                          9afa7ff3f7aa428183a5e955f5fbff4ec7fa9bbbfb2a56ba45cc7d292298f63f8146688fdc24e7297e321c25d80444906d7f8d7e0d57425c0323a55402faedbc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt
                          Filesize

                          204B

                          MD5

                          3a867dbadafcec64c75b10b7c0efab91

                          SHA1

                          e782224cb5f7eb9125dfff879cdab088348ba2f1

                          SHA256

                          d45b8b08fc57f063562aac178ed397dc34330a559a08042df202c052d0ce6232

                          SHA512

                          15ef9836a4811cc5210b2c547904053919bab86464e9edf70cf9646c5ae861168d051775ca1f108148352cd0f73b6c6bd88956cd629c6618fde1bd694cbe5d4e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt
                          Filesize

                          267B

                          MD5

                          eb0cd90631c251849d4eab8d937606ed

                          SHA1

                          30d7875c31b6865758becc4e0e4cc4a472a5af4d

                          SHA256

                          54b131a9d71bb89b4944b7732184b3226cc064dd1344769e609c43059b1fa39d

                          SHA512

                          6c6103a82cab16b3267846f14552552f57f41092730ea694512d0f2d461445a18615f00595e16ca22cc401b60dc9749a28ff2c9247cbff86e10e86908f678236

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt
                          Filesize

                          2KB

                          MD5

                          f6ec772ebf9f55a5dc27d311cc71f66e

                          SHA1

                          0ed206ffd5a0af37c7bcd754f5b52b02991b7c9d

                          SHA256

                          ce734cb5b28ea0a8439c76bd08b574034877b2e76f9292b9b934acbe8d58f2eb

                          SHA512

                          136b8a0c684b68edaff46c38490e290aa1a2728b1c674be207efafb43f715daeb835ed43c828c954191a06dff5f880755a1042a69d21d882a8fc70aef36620e0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt
                          Filesize

                          2KB

                          MD5

                          dc24ac2bd18de99a0e5a34f55111a00c

                          SHA1

                          4321ca8db8d7c0935eab11d80da2883ba2e5c514

                          SHA256

                          959a981a41c603cf6f7a769ebc0f2ca8c8cc493c644d25b883d8ed7dd345e9aa

                          SHA512

                          59789a4c7bf1563f304a48fc5f3267568ab7920ff241a32d7efa2da2c16cb6004974698bf912a4bbd74b815b7bd581aa379cba201cff07117dc4bc1907698e69

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt
                          Filesize

                          2KB

                          MD5

                          74e924dbecdefb2c1c67c9da8124c690

                          SHA1

                          6da9b32154a31f1689aab27c8d7966846c086e26

                          SHA256

                          bb7b539ea6e61709c1b123521fd93c0276373370e28b41cf4b3e8384892b3a35

                          SHA512

                          0b51f06e674ef495f8695d9e5b4c4a9e754e84ef260262fe63d0c460dc4d370bf0b11d88d5cd9fc64a4a4d11fb8b6b8d27e9a8067606b971c7436c6c5c30bc3e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt
                          Filesize

                          3KB

                          MD5

                          4c0c4d8b6d940d647ed7042e0d522c1f

                          SHA1

                          86becdf65ac7b2a7bd89e7fd793e25354c35346f

                          SHA256

                          55f1d607399be4f69407ed71467c25eab1c5d8aa35ee808e98ec341630ef5e8d

                          SHA512

                          712c2c019566315eb99bb135872f86188aa401bca15ae48b0fc7775eb27a89101aae639b5ff5db962d1fce859ecf1049da51ff5069c7c04ce55a9edf67e8f827

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt
                          Filesize

                          3KB

                          MD5

                          921884beb09d4bbe3c9a9b9937fad10c

                          SHA1

                          230c1ad645d1c7e21e5dd48b61ec49469782f630

                          SHA256

                          cf1601a1ca122a1854660ee4f172e124b847da0d6ff7dedf68a03dc87554497e

                          SHA512

                          b5a1c2f70eb46344c5100eed9cb883a278fdf0de2115403e6d753bc594d6acd0a050b0f7216f80aa7c75b23987e9044fbbbb6c684a7001254fed7f83bcd032d6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt
                          Filesize

                          3KB

                          MD5

                          166561f756238105ae2662261fe97fd2

                          SHA1

                          5382b206c113e6636ee1698d7bd8b6b6b6d5e4ae

                          SHA256

                          3a191f56462d5803f1b9ce1706a097edab739557e3b5205069e13803e22d1b39

                          SHA512

                          8b24bc0638d1a25bbf95d904164f8fb8698f2c78465b88b0ada4481ce21e1fab2b55c93e6c8d502cdb661209e385c072257ca2b42740c589aa580f7672bb87f8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt
                          Filesize

                          3KB

                          MD5

                          7ca781de9b23ced92b86d39988ad2c00

                          SHA1

                          9be16bfe097c8104aba6040f1378b1480c4b5e5d

                          SHA256

                          2245c16a4780c5127fa9357ab7b0e863846429694a50121436a48652ed005cb0

                          SHA512

                          737f34ae6d39ef62bb235d37a16e477bbff0254a4869a75645b5491e242fd48cf7ad31a9f60ea293d86f02836daa598d4975cf4edb279a75dd9be35a1fb4e45f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt
                          Filesize

                          3KB

                          MD5

                          3e764cc1046e2488d5912bd12a19750c

                          SHA1

                          19e65eeb707e091e8d458191edcb87a0e8081a5b

                          SHA256

                          79e8aefd617551a23be60bfff35eebcfc9fd8bd6ab90e4ab67877bf483008492

                          SHA512

                          e6205de083e0d73d7fe11911d6ab9dcdde1dc374ca173d4dc18d2806e23f39321e846da8590efffb92d73da314fea6d202a3ba1db396ae8899da6114921a5492

                          Download Submit

                        • C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\WorldWind.jpg
                          Filesize

                          45KB

                          MD5

                          8fa2d29a833d17f058a241a80e36cd30

                          SHA1

                          07aa9422d2a8c35a1211732bab857d4c48e58de8

                          SHA256

                          ff917b0ff899a9956e1fd691560b368a959478f0559f20e19e0e91f4ec41aeb4

                          SHA512

                          6da0aece03b2ff03daacf7141fadae2d05f0dea47b6861353afb05529e50b1c06446fff49087c65735f77b9c4f2636fe033a591ac57ddbeeb8394f0a289ca1df

                          Download Submit

                        • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
                          Filesize

                          330KB

                          MD5

                          75e456775c0a52b6bbe724739fa3b4a7

                          SHA1

                          1f4c575e98d48775f239ceae474e03a3058099ea

                          SHA256

                          e8d52d0d352317b3da0be6673099d32e10e7b0e44d23a0c1a6a5277d37b95cf3

                          SHA512

                          b376146c6fa91f741d69acf7b02a57442d2ea059be37b9bdb06af6cc01272f4ded1a82e4e21b9c803d0e91e22fc12f70391f5e8c8704d51b2435afc9624e8471

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\places.raw
                          Filesize

                          5.0MB

                          MD5

                          37c0ccc36df7aacfa0ff975a51e0212d

                          SHA1

                          aacb3c8c982dc134909c078f9523418f8486b2e9

                          SHA256

                          d0ef7ee080e5bfa8c0f781f223b4f4c888689f34f41392f546b5bad891286280

                          SHA512

                          892d091d7b71da5ff556d80c3d8953eb60a62da6e2aeb26932483dafb5c7002fa56aef00b507e87f28aecfa6dc67793b558cb5ca639cb50c552162715710dcb7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpA074.tmp.dat
                          Filesize

                          92KB

                          MD5

                          9dacdf7238269810f4c56455bc02a2b5

                          SHA1

                          a4fdddc32f512bc7b3973b0026a65c61f0c09823

                          SHA256

                          96b70070ce33ffeec40bed34dbbed3b79b32d709e5f0c422ce4448b2574a8d8a

                          SHA512

                          05214bc2eea84586a19a35713a5132a2453ff6dc9b6bfa1304fc2fc9e89e05d250378102b04c692004c38d4caa1a334cdc01b827f0cfaee9d276cbd6ea95cd47

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpA085.tmp.dat
                          Filesize

                          148KB

                          MD5

                          90a1d4b55edf36fa8b4cc6974ed7d4c4

                          SHA1

                          aba1b8d0e05421e7df5982899f626211c3c4b5c1

                          SHA256

                          7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

                          SHA512

                          ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpA8ED.tmp.dat
                          Filesize

                          46KB

                          MD5

                          02d2c46697e3714e49f46b680b9a6b83

                          SHA1

                          84f98b56d49f01e9b6b76a4e21accf64fd319140

                          SHA256

                          522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                          SHA512

                          60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpA96E.tmp.dat
                          Filesize

                          96KB

                          MD5

                          d367ddfda80fdcf578726bc3b0bc3e3c

                          SHA1

                          23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

                          SHA256

                          0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

                          SHA512

                          40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

                          Download Submit

                        • memory/2684-0-0x000007FEF6343000-0x000007FEF6344000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2684-1-0x0000000000150000-0x00000000001AC000-memory.dmp

                          Filesize

                          368KB

                          Download

                        • memory/2684-9-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/2684-8-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/2848-12-0x00000000002B0000-0x00000000002BA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2848-10-0x0000000000EF0000-0x0000000000F48000-memory.dmp

                          Filesize

                          352KB

                          Download

                        • memory/2848-11-0x0000000000C10000-0x0000000000C5A000-memory.dmp

                          Filesize

                          296KB

                          Download

                        • memory/2904-14-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/2904-27-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/2904-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2904-20-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/2904-16-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/2904-25-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/2904-23-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/2904-18-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/2944-150-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download