asyncrat | 9d9a79f4ae9bf7a992945f6c06c5bec642c05e4e828217c50255dabfa3677006

max time kernel
19s
max time network
25s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-09-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RebelCracked.exe
Size

344KB
MD5

a84fd0fc75b9c761e9b7923a08da41c7
SHA1

2597048612041cd7a8c95002c73e9c2818bb2097
SHA256

9d9a79f4ae9bf7a992945f6c06c5bec642c05e4e828217c50255dabfa3677006
SHA512

a17f1144a0e3ce07c7ed6891987c5b969f291e9991442c33750028d35e2194794e8a649c397e8afc9f8ce19d485c453600c75cab4fcead09e38414d85819251a
SSDEEP

6144:lOcpeK8lucxAtLNFHUVuI/2zj1z6jZ755NofmWx4PCQL23wBw7R0ljTwrVuAdJKp:QcpSnx0LNFDQ60Ntbo5d7gBw7R7rbdJk

Score

10^/10

asyncrat stormkitty default discovery persistence privilege_escalation rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 5 IoCs

resource	yara_rule
behavioral1/memory/2904-27-0x0000000000400000-0x0000000000432000-memory.dmp	family_stormkitty
behavioral1/memory/2904-20-0x0000000000400000-0x0000000000432000-memory.dmp	family_stormkitty
behavioral1/memory/2904-25-0x0000000000400000-0x0000000000432000-memory.dmp	family_stormkitty
behavioral1/memory/2904-23-0x0000000000400000-0x0000000000432000-memory.dmp	family_stormkitty
behavioral1/memory/2904-18-0x0000000000400000-0x0000000000432000-memory.dmp	family_stormkitty

Executes dropped EXE 16 IoCs

pid	Process
2848	RuntimeBroker.exe
2904	RuntimeBroker.exe
1660	RuntimeBroker.exe
1424	RuntimeBroker.exe
2432	RuntimeBroker.exe
2820	RuntimeBroker.exe
1572	RuntimeBroker.exe
1740	RuntimeBroker.exe
1808	RuntimeBroker.exe
2944	RuntimeBroker.exe
2664	RuntimeBroker.exe
2212	RuntimeBroker.exe
1632	RuntimeBroker.exe
596	RuntimeBroker.exe
2972	RuntimeBroker.exe
2056	RuntimeBroker.exe

Loads dropped DLL 1 IoCs

pid	Process
2848	RuntimeBroker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\7d1bfdb3dcf00dff75fe258c0041097d\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\7d1bfdb3dcf00dff75fe258c0041097d\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\4afe061c659a0e0a726e9cea1ba1d146\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\cf4513f78e94d3d33af18a9951a75e10\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\cf4513f78e94d3d33af18a9951a75e10\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\c02199669cf74979f2f2c3a9189c6864\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\7d1bfdb3dcf00dff75fe258c0041097d\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\7d1bfdb3dcf00dff75fe258c0041097d\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\cf4513f78e94d3d33af18a9951a75e10\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\c02199669cf74979f2f2c3a9189c6864\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\c02199669cf74979f2f2c3a9189c6864\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\cf4513f78e94d3d33af18a9951a75e10\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\7d1bfdb3dcf00dff75fe258c0041097d\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\4afe061c659a0e0a726e9cea1ba1d146\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\4afe061c659a0e0a726e9cea1ba1d146\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\4afe061c659a0e0a726e9cea1ba1d146\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\4afe061c659a0e0a726e9cea1ba1d146\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\cf4513f78e94d3d33af18a9951a75e10\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\c02199669cf74979f2f2c3a9189c6864\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\c02199669cf74979f2f2c3a9189c6864\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\c02199669cf74979f2f2c3a9189c6864\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	RuntimeBroker.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2848 set thread context of 2904	2848	RuntimeBroker.exe	32
PID 1660 set thread context of 1424	1660	RuntimeBroker.exe	36
PID 2432 set thread context of 2820	2432	RuntimeBroker.exe	39
PID 1572 set thread context of 1740	1572	RuntimeBroker.exe	43
PID 1808 set thread context of 2944	1808	RuntimeBroker.exe	48
PID 2664 set thread context of 2212	2664	RuntimeBroker.exe	60
PID 1632 set thread context of 596	1632	RuntimeBroker.exe	72
PID 2972 set thread context of 2056	2972	RuntimeBroker.exe	84

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 9 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2556	netsh.exe
2268	cmd.exe
1660	netsh.exe
2316	cmd.exe
2332	netsh.exe
2104	cmd.exe
1148	cmd.exe
1800	cmd.exe
2284	netsh.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2904	RuntimeBroker.exe
2904	RuntimeBroker.exe
2904	RuntimeBroker.exe
2904	RuntimeBroker.exe
2904	RuntimeBroker.exe
1424	RuntimeBroker.exe
1424	RuntimeBroker.exe
2820	RuntimeBroker.exe
2820	RuntimeBroker.exe
1424	RuntimeBroker.exe
1424	RuntimeBroker.exe
1424	RuntimeBroker.exe
1424	RuntimeBroker.exe
1424	RuntimeBroker.exe
2820	RuntimeBroker.exe
2820	RuntimeBroker.exe
1740	RuntimeBroker.exe
1740	RuntimeBroker.exe
2820	RuntimeBroker.exe
2820	RuntimeBroker.exe
2820	RuntimeBroker.exe
2944	RuntimeBroker.exe
1740	RuntimeBroker.exe
1740	RuntimeBroker.exe
2944	RuntimeBroker.exe
1740	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	RuntimeBroker.exe
Token: SeDebugPrivilege	1424	RuntimeBroker.exe
Token: SeDebugPrivilege	2820	RuntimeBroker.exe
Token: SeDebugPrivilege	1740	RuntimeBroker.exe
Token: SeDebugPrivilege	2944	RuntimeBroker.exe
Token: SeDebugPrivilege	2212	RuntimeBroker.exe
Token: SeDebugPrivilege	596	RuntimeBroker.exe
Token: SeDebugPrivilege	2056	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2848	2684	RebelCracked.exe	30
PID 2684 wrote to memory of 2848	2684	RebelCracked.exe	30
PID 2684 wrote to memory of 2848	2684	RebelCracked.exe	30
PID 2684 wrote to memory of 2848	2684	RebelCracked.exe	30
PID 2684 wrote to memory of 2284	2684	RebelCracked.exe	31
PID 2684 wrote to memory of 2284	2684	RebelCracked.exe	31
PID 2684 wrote to memory of 2284	2684	RebelCracked.exe	31
PID 2848 wrote to memory of 2904	2848	RuntimeBroker.exe	32
PID 2848 wrote to memory of 2904	2848	RuntimeBroker.exe	32
PID 2848 wrote to memory of 2904	2848	RuntimeBroker.exe	32
PID 2848 wrote to memory of 2904	2848	RuntimeBroker.exe	32
PID 2848 wrote to memory of 2904	2848	RuntimeBroker.exe	32
PID 2848 wrote to memory of 2904	2848	RuntimeBroker.exe	32
PID 2848 wrote to memory of 2904	2848	RuntimeBroker.exe	32
PID 2848 wrote to memory of 2904	2848	RuntimeBroker.exe	32
PID 2848 wrote to memory of 2904	2848	RuntimeBroker.exe	32
PID 2284 wrote to memory of 1660	2284	RebelCracked.exe	33
PID 2284 wrote to memory of 1660	2284	RebelCracked.exe	33
PID 2284 wrote to memory of 1660	2284	RebelCracked.exe	33
PID 2284 wrote to memory of 1660	2284	RebelCracked.exe	33
PID 2284 wrote to memory of 2616	2284	RebelCracked.exe	34
PID 2284 wrote to memory of 2616	2284	RebelCracked.exe	34
PID 2284 wrote to memory of 2616	2284	RebelCracked.exe	34
PID 1660 wrote to memory of 988	1660	RuntimeBroker.exe	35
PID 1660 wrote to memory of 988	1660	RuntimeBroker.exe	35
PID 1660 wrote to memory of 988	1660	RuntimeBroker.exe	35
PID 1660 wrote to memory of 988	1660	RuntimeBroker.exe	35
PID 1660 wrote to memory of 1424	1660	RuntimeBroker.exe	36
PID 1660 wrote to memory of 1424	1660	RuntimeBroker.exe	36
PID 1660 wrote to memory of 1424	1660	RuntimeBroker.exe	36
PID 1660 wrote to memory of 1424	1660	RuntimeBroker.exe	36
PID 1660 wrote to memory of 1424	1660	RuntimeBroker.exe	36
PID 1660 wrote to memory of 1424	1660	RuntimeBroker.exe	36
PID 1660 wrote to memory of 1424	1660	RuntimeBroker.exe	36
PID 1660 wrote to memory of 1424	1660	RuntimeBroker.exe	36
PID 1660 wrote to memory of 1424	1660	RuntimeBroker.exe	36
PID 2616 wrote to memory of 2432	2616	RebelCracked.exe	37
PID 2616 wrote to memory of 2432	2616	RebelCracked.exe	37
PID 2616 wrote to memory of 2432	2616	RebelCracked.exe	37
PID 2616 wrote to memory of 2432	2616	RebelCracked.exe	37
PID 2616 wrote to memory of 2148	2616	RebelCracked.exe	38
PID 2616 wrote to memory of 2148	2616	RebelCracked.exe	38
PID 2616 wrote to memory of 2148	2616	RebelCracked.exe	38
PID 2432 wrote to memory of 2820	2432	RuntimeBroker.exe	39
PID 2432 wrote to memory of 2820	2432	RuntimeBroker.exe	39
PID 2432 wrote to memory of 2820	2432	RuntimeBroker.exe	39
PID 2432 wrote to memory of 2820	2432	RuntimeBroker.exe	39
PID 2432 wrote to memory of 2820	2432	RuntimeBroker.exe	39
PID 2432 wrote to memory of 2820	2432	RuntimeBroker.exe	39
PID 2432 wrote to memory of 2820	2432	RuntimeBroker.exe	39
PID 2432 wrote to memory of 2820	2432	RuntimeBroker.exe	39
PID 2432 wrote to memory of 2820	2432	RuntimeBroker.exe	39
PID 2148 wrote to memory of 1572	2148	RebelCracked.exe	41
PID 2148 wrote to memory of 1572	2148	RebelCracked.exe	41
PID 2148 wrote to memory of 1572	2148	RebelCracked.exe	41
PID 2148 wrote to memory of 1572	2148	RebelCracked.exe	41
PID 2148 wrote to memory of 1760	2148	RebelCracked.exe	42
PID 2148 wrote to memory of 1760	2148	RebelCracked.exe	42
PID 2148 wrote to memory of 1760	2148	RebelCracked.exe	42
PID 1572 wrote to memory of 1740	1572	RuntimeBroker.exe	43
PID 1572 wrote to memory of 1740	1572	RuntimeBroker.exe	43
PID 1572 wrote to memory of 1740	1572	RuntimeBroker.exe	43
PID 1572 wrote to memory of 1740	1572	RuntimeBroker.exe	43
PID 1572 wrote to memory of 1740	1572	RuntimeBroker.exe	43

C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1800
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:636
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2284
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1416
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      System Location Discovery: System Language Discovery
      PID:2436
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:336
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1660
- C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
  "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
      4⤵
      PID:988
  - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1424
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2316
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2332
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2704
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2680
- - C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
    "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        5⤵
        Executes dropped EXE
        Drops desktop.ini file(s)
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2268
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1660
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1200
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1804
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
      "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1572
      - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        6⤵
        Executes dropped EXE
        Drops desktop.ini file(s)
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2104
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2556
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1372
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
        5⤵
        
        PID:1760
      - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        7⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        7⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        7⤵
        Executes dropped EXE
        Drops desktop.ini file(s)
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
        6⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
        8⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
        9⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        10⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        11⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"
        10⤵
        
        PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\0ee64e7d9a23a8545451f681e806e104\msgid.dat

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Desktop.txt

Filesize
529B

MD5
6f6e0fc9fedce8697713a6aa14a8436c

SHA1
bbbe9c02c459b51c6a7c6a686891aba0c683e111

SHA256
e3ba6c14ad8f1e164e508f60e5ed7e1c754acf728ac3e4842336a8d10485a7bc

SHA512
8fe0771d546d124fecd1ce00ae358afa1a8a4874cfd6b04a1f5508dd5fea53c01b5df282177c67541b621ae48e7d31849b23ad7f34b28be7821f1a6d53ebdefa

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Documents.txt

Filesize
650B

MD5
4baf19fcd435da8d338d24764590f436

SHA1
c05a5343fe7f96e2d908e8436be4ce94b1a2eca4

SHA256
16793007724acffe9708c5ccfa81b68d9f98cbb3ab341fd6eec6c4238b7f4e76

SHA512
ae354d740c91d52ca6e4ae894f4ddd7804158c300b18d7950d028dec3e9df1b87d829a26606499616e3e4098f2081d7459a2510bb1853ed62cf95e11417fff87

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Downloads.txt

Filesize
722B

MD5
868ae0d35aaef9de35a2b4e2ca33683a

SHA1
f59032206e70a33bdc12ead57a0130df479b7707

SHA256
c9109a6800f643d4ff66dcc1ba06f05a2d1ac669bb313dcc3e2855fa24f6f488

SHA512
ada102de607a765e56de27d430dda826b1874161aacf59a2e04d5d2a1813be28fbc5315ec09e729cd6fa822defd914a0f071340f5964d49d88ce07bb3bccb2e2

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Pictures.txt

Filesize
719B

MD5
77326c9e7599d9c3d8679d3d887ca8d7

SHA1
1731657e370ac322e6b3218efc7ce96661f95c8d

SHA256
7a88a3a64ed1bc64a9335535f3d61e5264dfd8f312740b691972fd90abee5709

SHA512
a47c41c631efc46ba6dfc568267063508239c4b2aa309a7350858fb045e05b6e446cd928002868d83c4e0bf4ff7c35935b353a987284635a5a5d2806b61202bc

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Startup.txt

Filesize
24B

MD5
68c93da4981d591704cea7b71cebfb97

SHA1
fd0f8d97463cd33892cc828b4ad04e03fc014fa6

SHA256
889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

SHA512
63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Temp.txt

Filesize
2KB

MD5
11da0ed48136bb264bcdf0c0ef4ecce1

SHA1
78b134e379df9dfebac99c8a221efdc3a1582d6b

SHA256
fedeb4891bb749272c6806bdb29a1c8f64e2a0c6abd9daab1b07402351767a50

SHA512
708f579b5f5a8609b7dcea8607e55d13af859bf9d56de41e06b4fe912d621f08de594badc6b93419711db4cbc25791ac685f2c24e3ccfd8c37b563f4b2becb2c

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Directories\Videos.txt

Filesize
23B

MD5
1fddbf1169b6c75898b86e7e24bc7c1f

SHA1
d2091060cb5191ff70eb99c0088c182e80c20f8c

SHA256
a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

SHA512
20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini

Filesize
282B

MD5
9e36cc3537ee9ee1e3b10fa4e761045b

SHA1
7726f55012e1e26cc762c9982e7c6c54ca7bb303

SHA256
4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026

SHA512
5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini

Filesize
402B

MD5
ecf88f261853fe08d58e2e903220da14

SHA1
f72807a9e081906654ae196605e681d5938a2e6c

SHA256
cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844

SHA512
82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini

Filesize
282B

MD5
3a37312509712d4e12d27240137ff377

SHA1
30ced927e23b584725cf16351394175a6d2a9577

SHA256
b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3

SHA512
dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini

Filesize
504B

MD5
29eae335b77f438e05594d86a6ca22ff

SHA1
d62ccc830c249de6b6532381b4c16a5f17f95d89

SHA256
88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4

SHA512
5d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt

Filesize
62B

MD5
9a2d2d7054a7ae9a476ac69345b3ba1b

SHA1
1d06a9295a0f7f56e596cc69efcbc3ff72fbe737

SHA256
4a68c1976a4c217b9097ab19c3352602df9f1db48908dcba108bca5befbc5121

SHA512
afa1f46a538231b5ebd5d4679a685b9f0f1d3c67b92925f20cb8584bc8f90a42d58100b2841c0ebade54e2201594a534a9f64f6b4a3a1d9942c18ae1f93c1b28

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt

Filesize
133B

MD5
9b8cf6ad60da4c5e7ecb494e859882fe

SHA1
eda362163f2b1d0706bc364ddbac7fb844d90a81

SHA256
52b15f078c4ae6f3100697462c4ba8b3c6c1bb648dc45c5f76b864fdb58f25ae

SHA512
9afa7ff3f7aa428183a5e955f5fbff4ec7fa9bbbfb2a56ba45cc7d292298f63f8146688fdc24e7297e321c25d80444906d7f8d7e0d57425c0323a55402faedbc

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt

Filesize
204B

MD5
3a867dbadafcec64c75b10b7c0efab91

SHA1
e782224cb5f7eb9125dfff879cdab088348ba2f1

SHA256
d45b8b08fc57f063562aac178ed397dc34330a559a08042df202c052d0ce6232

SHA512
15ef9836a4811cc5210b2c547904053919bab86464e9edf70cf9646c5ae861168d051775ca1f108148352cd0f73b6c6bd88956cd629c6618fde1bd694cbe5d4e

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt

Filesize
267B

MD5
eb0cd90631c251849d4eab8d937606ed

SHA1
30d7875c31b6865758becc4e0e4cc4a472a5af4d

SHA256
54b131a9d71bb89b4944b7732184b3226cc064dd1344769e609c43059b1fa39d

SHA512
6c6103a82cab16b3267846f14552552f57f41092730ea694512d0f2d461445a18615f00595e16ca22cc401b60dc9749a28ff2c9247cbff86e10e86908f678236

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt

Filesize
2KB

MD5
f6ec772ebf9f55a5dc27d311cc71f66e

SHA1
0ed206ffd5a0af37c7bcd754f5b52b02991b7c9d

SHA256
ce734cb5b28ea0a8439c76bd08b574034877b2e76f9292b9b934acbe8d58f2eb

SHA512
136b8a0c684b68edaff46c38490e290aa1a2728b1c674be207efafb43f715daeb835ed43c828c954191a06dff5f880755a1042a69d21d882a8fc70aef36620e0

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt

Filesize
2KB

MD5
dc24ac2bd18de99a0e5a34f55111a00c

SHA1
4321ca8db8d7c0935eab11d80da2883ba2e5c514

SHA256
959a981a41c603cf6f7a769ebc0f2ca8c8cc493c644d25b883d8ed7dd345e9aa

SHA512
59789a4c7bf1563f304a48fc5f3267568ab7920ff241a32d7efa2da2c16cb6004974698bf912a4bbd74b815b7bd581aa379cba201cff07117dc4bc1907698e69

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt

Filesize
2KB

MD5
74e924dbecdefb2c1c67c9da8124c690

SHA1
6da9b32154a31f1689aab27c8d7966846c086e26

SHA256
bb7b539ea6e61709c1b123521fd93c0276373370e28b41cf4b3e8384892b3a35

SHA512
0b51f06e674ef495f8695d9e5b4c4a9e754e84ef260262fe63d0c460dc4d370bf0b11d88d5cd9fc64a4a4d11fb8b6b8d27e9a8067606b971c7436c6c5c30bc3e

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt

Filesize
3KB

MD5
4c0c4d8b6d940d647ed7042e0d522c1f

SHA1
86becdf65ac7b2a7bd89e7fd793e25354c35346f

SHA256
55f1d607399be4f69407ed71467c25eab1c5d8aa35ee808e98ec341630ef5e8d

SHA512
712c2c019566315eb99bb135872f86188aa401bca15ae48b0fc7775eb27a89101aae639b5ff5db962d1fce859ecf1049da51ff5069c7c04ce55a9edf67e8f827

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt

Filesize
3KB

MD5
921884beb09d4bbe3c9a9b9937fad10c

SHA1
230c1ad645d1c7e21e5dd48b61ec49469782f630

SHA256
cf1601a1ca122a1854660ee4f172e124b847da0d6ff7dedf68a03dc87554497e

SHA512
b5a1c2f70eb46344c5100eed9cb883a278fdf0de2115403e6d753bc594d6acd0a050b0f7216f80aa7c75b23987e9044fbbbb6c684a7001254fed7f83bcd032d6

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt

Filesize
3KB

MD5
166561f756238105ae2662261fe97fd2

SHA1
5382b206c113e6636ee1698d7bd8b6b6b6d5e4ae

SHA256
3a191f56462d5803f1b9ce1706a097edab739557e3b5205069e13803e22d1b39

SHA512
8b24bc0638d1a25bbf95d904164f8fb8698f2c78465b88b0ada4481ce21e1fab2b55c93e6c8d502cdb661209e385c072257ca2b42740c589aa580f7672bb87f8

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt

Filesize
3KB

MD5
7ca781de9b23ced92b86d39988ad2c00

SHA1
9be16bfe097c8104aba6040f1378b1480c4b5e5d

SHA256
2245c16a4780c5127fa9357ab7b0e863846429694a50121436a48652ed005cb0

SHA512
737f34ae6d39ef62bb235d37a16e477bbff0254a4869a75645b5491e242fd48cf7ad31a9f60ea293d86f02836daa598d4975cf4edb279a75dd9be35a1fb4e45f

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\Process.txt

Filesize
3KB

MD5
3e764cc1046e2488d5912bd12a19750c

SHA1
19e65eeb707e091e8d458191edcb87a0e8081a5b

SHA256
79e8aefd617551a23be60bfff35eebcfc9fd8bd6ab90e4ab67877bf483008492

SHA512
e6205de083e0d73d7fe11911d6ab9dcdde1dc374ca173d4dc18d2806e23f39321e846da8590efffb92d73da314fea6d202a3ba1db396ae8899da6114921a5492

Download Submit
C:\Users\Admin\AppData\Local\85d79f40cf043db9d25fbb21cc3e56c2\Admin@KHBTHJFA_en-US\System\WorldWind.jpg

Filesize
45KB

MD5
8fa2d29a833d17f058a241a80e36cd30

SHA1
07aa9422d2a8c35a1211732bab857d4c48e58de8

SHA256
ff917b0ff899a9956e1fd691560b368a959478f0559f20e19e0e91f4ec41aeb4

SHA512
6da0aece03b2ff03daacf7141fadae2d05f0dea47b6861353afb05529e50b1c06446fff49087c65735f77b9c4f2636fe033a591ac57ddbeeb8394f0a289ca1df

Download Submit
C:\Users\Admin\AppData\Local\RuntimeBroker.exe

Filesize
330KB

MD5
75e456775c0a52b6bbe724739fa3b4a7

SHA1
1f4c575e98d48775f239ceae474e03a3058099ea

SHA256
e8d52d0d352317b3da0be6673099d32e10e7b0e44d23a0c1a6a5277d37b95cf3

SHA512
b376146c6fa91f741d69acf7b02a57442d2ea059be37b9bdb06af6cc01272f4ded1a82e4e21b9c803d0e91e22fc12f70391f5e8c8704d51b2435afc9624e8471

Download Submit
C:\Users\Admin\AppData\Local\Temp\places.raw

Filesize
5.0MB

MD5
37c0ccc36df7aacfa0ff975a51e0212d

SHA1
aacb3c8c982dc134909c078f9523418f8486b2e9

SHA256
d0ef7ee080e5bfa8c0f781f223b4f4c888689f34f41392f546b5bad891286280

SHA512
892d091d7b71da5ff556d80c3d8953eb60a62da6e2aeb26932483dafb5c7002fa56aef00b507e87f28aecfa6dc67793b558cb5ca639cb50c552162715710dcb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA074.tmp.dat

Filesize
92KB

MD5
9dacdf7238269810f4c56455bc02a2b5

SHA1
a4fdddc32f512bc7b3973b0026a65c61f0c09823

SHA256
96b70070ce33ffeec40bed34dbbed3b79b32d709e5f0c422ce4448b2574a8d8a

SHA512
05214bc2eea84586a19a35713a5132a2453ff6dc9b6bfa1304fc2fc9e89e05d250378102b04c692004c38d4caa1a334cdc01b827f0cfaee9d276cbd6ea95cd47

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA085.tmp.dat

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA8ED.tmp.dat

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA96E.tmp.dat

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
memory/2684-0-0x000007FEF6343000-0x000007FEF6344000-memory.dmp

Filesize
4KB

Download
memory/2684-1-0x0000000000150000-0x00000000001AC000-memory.dmp

Filesize
368KB

Download
memory/2684-9-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2684-8-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2848-12-0x00000000002B0000-0x00000000002BA000-memory.dmp

Filesize
40KB

Download
memory/2848-10-0x0000000000EF0000-0x0000000000F48000-memory.dmp

Filesize
352KB

Download
memory/2848-11-0x0000000000C10000-0x0000000000C5A000-memory.dmp

Filesize
296KB

Download
memory/2904-14-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2904-27-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2904-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2904-20-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2904-16-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2904-25-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2904-23-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2904-18-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2944-150-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download