asyncrat | cef9230ad3111e4a233e61b49ac977d4d25849061a90b05c3e7d6f308022b4de

Analysis

max time kernel
85s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2024, 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rebel.7z
Size

8.1MB
MD5

4a8429dd823216bda95f67f85483a8d9
SHA1

77640784d85848c945820d37794839f346f138d2
SHA256

cef9230ad3111e4a233e61b49ac977d4d25849061a90b05c3e7d6f308022b4de
SHA512

1d4d41cee280c62657b17c2ddc11fc7ce6bab42204d94fe05eed263d139765c19dfd16f2fde4b4e5e8b925c39945c3208600a2bfad941e4723d3bfeb7c30b91a
SSDEEP

196608:15bVwZ4n4D4PLSFpJah2Hc4sEYcGijKseRAKvpZheSaE:155EAWpSt/DcFjqRAKvnhpd

Score

10^/10

asyncrat stormkitty default discovery rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/5080-58-0x0000000000400000-0x0000000000432000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	RebelCracked.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	RebelCracked.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	RebelCracked.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	RebelCracked.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	RebelCracked.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	RebelCracked.exe

Executes dropped EXE 19 IoCs

pid	Process
5020	RebelCracked.exe
2332	RuntimeBroker.exe
4276	RebelCracked.exe
5080	RuntimeBroker.exe
1588	RuntimeBroker.exe
3464	RebelCracked.exe
3248	RuntimeBroker.exe
3748	RuntimeBroker.exe
824	RebelCracked.exe
3228	RuntimeBroker.exe
1088	RuntimeBroker.exe
408	RebelCracked.exe
800	RuntimeBroker.exe
3188	RuntimeBroker.exe
1136	RebelCracked.exe
3428	RuntimeBroker.exe
4056	RuntimeBroker.exe
2472	RebelCracked.exe
3704	RuntimeBroker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 22 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\3c271aecb54282152a1b91b23790688e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\a7e66168c532deaba931e9a4083d499e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\a7e66168c532deaba931e9a4083d499e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\a7e66168c532deaba931e9a4083d499e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\3c271aecb54282152a1b91b23790688e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\a7e66168c532deaba931e9a4083d499e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\a7e66168c532deaba931e9a4083d499e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\3c271aecb54282152a1b91b23790688e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\3c271aecb54282152a1b91b23790688e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\a7e66168c532deaba931e9a4083d499e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\3c271aecb54282152a1b91b23790688e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\3c271aecb54282152a1b91b23790688e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\3c271aecb54282152a1b91b23790688e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\a7e66168c532deaba931e9a4083d499e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\3c271aecb54282152a1b91b23790688e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File created	C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	RuntimeBroker.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
48	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2332 set thread context of 5080	2332	RuntimeBroker.exe	98
PID 1588 set thread context of 3248	1588	RuntimeBroker.exe	101
PID 3748 set thread context of 3228	3748	RuntimeBroker.exe	104
PID 1088 set thread context of 800	1088	RuntimeBroker.exe	107
PID 3188 set thread context of 3428	3188	RuntimeBroker.exe	111
PID 4056 set thread context of 3704	4056	RuntimeBroker.exe	114

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 8 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2520	cmd.exe
1148	netsh.exe
4472	cmd.exe
3756	netsh.exe
2396	cmd.exe
2536	netsh.exe
824	cmd.exe
3924	netsh.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5080	RuntimeBroker.exe
5080	RuntimeBroker.exe
3248	RuntimeBroker.exe
3248	RuntimeBroker.exe
5080	RuntimeBroker.exe
5080	RuntimeBroker.exe
5080	RuntimeBroker.exe
5080	RuntimeBroker.exe
3248	RuntimeBroker.exe
3248	RuntimeBroker.exe
5080	RuntimeBroker.exe
5080	RuntimeBroker.exe
5080	RuntimeBroker.exe
5080	RuntimeBroker.exe
3248	RuntimeBroker.exe
3248	RuntimeBroker.exe
3248	RuntimeBroker.exe
3248	RuntimeBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3160	7zFM.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	3160	7zFM.exe
Token: 35	3160	7zFM.exe
Token: SeSecurityPrivilege	3160	7zFM.exe
Token: SeSecurityPrivilege	3160	7zFM.exe
Token: SeDebugPrivilege	5080	RuntimeBroker.exe
Token: SeDebugPrivilege	3248	RuntimeBroker.exe
Token: SeDebugPrivilege	3228	RuntimeBroker.exe
Token: SeDebugPrivilege	800	RuntimeBroker.exe
Token: SeDebugPrivilege	3428	RuntimeBroker.exe
Token: SeDebugPrivilege	3704	RuntimeBroker.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3160	7zFM.exe
3160	7zFM.exe
3160	7zFM.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 2332	5020	RebelCracked.exe	96
PID 5020 wrote to memory of 2332	5020	RebelCracked.exe	96
PID 5020 wrote to memory of 2332	5020	RebelCracked.exe	96
PID 5020 wrote to memory of 4276	5020	RebelCracked.exe	97
PID 5020 wrote to memory of 4276	5020	RebelCracked.exe	97
PID 2332 wrote to memory of 5080	2332	RuntimeBroker.exe	98
PID 2332 wrote to memory of 5080	2332	RuntimeBroker.exe	98
PID 2332 wrote to memory of 5080	2332	RuntimeBroker.exe	98
PID 2332 wrote to memory of 5080	2332	RuntimeBroker.exe	98
PID 2332 wrote to memory of 5080	2332	RuntimeBroker.exe	98
PID 2332 wrote to memory of 5080	2332	RuntimeBroker.exe	98
PID 2332 wrote to memory of 5080	2332	RuntimeBroker.exe	98
PID 2332 wrote to memory of 5080	2332	RuntimeBroker.exe	98
PID 4276 wrote to memory of 1588	4276	RebelCracked.exe	99
PID 4276 wrote to memory of 1588	4276	RebelCracked.exe	99
PID 4276 wrote to memory of 1588	4276	RebelCracked.exe	99
PID 4276 wrote to memory of 3464	4276	RebelCracked.exe	100
PID 4276 wrote to memory of 3464	4276	RebelCracked.exe	100
PID 1588 wrote to memory of 3248	1588	RuntimeBroker.exe	101
PID 1588 wrote to memory of 3248	1588	RuntimeBroker.exe	101
PID 1588 wrote to memory of 3248	1588	RuntimeBroker.exe	101
PID 1588 wrote to memory of 3248	1588	RuntimeBroker.exe	101
PID 1588 wrote to memory of 3248	1588	RuntimeBroker.exe	101
PID 1588 wrote to memory of 3248	1588	RuntimeBroker.exe	101
PID 1588 wrote to memory of 3248	1588	RuntimeBroker.exe	101
PID 1588 wrote to memory of 3248	1588	RuntimeBroker.exe	101
PID 3464 wrote to memory of 3748	3464	RebelCracked.exe	102
PID 3464 wrote to memory of 3748	3464	RebelCracked.exe	102
PID 3464 wrote to memory of 3748	3464	RebelCracked.exe	102
PID 3464 wrote to memory of 824	3464	RebelCracked.exe	103
PID 3464 wrote to memory of 824	3464	RebelCracked.exe	103
PID 3748 wrote to memory of 3228	3748	RuntimeBroker.exe	104
PID 3748 wrote to memory of 3228	3748	RuntimeBroker.exe	104
PID 3748 wrote to memory of 3228	3748	RuntimeBroker.exe	104
PID 3748 wrote to memory of 3228	3748	RuntimeBroker.exe	104
PID 3748 wrote to memory of 3228	3748	RuntimeBroker.exe	104
PID 3748 wrote to memory of 3228	3748	RuntimeBroker.exe	104
PID 3748 wrote to memory of 3228	3748	RuntimeBroker.exe	104
PID 3748 wrote to memory of 3228	3748	RuntimeBroker.exe	104
PID 824 wrote to memory of 1088	824	RebelCracked.exe	105
PID 824 wrote to memory of 1088	824	RebelCracked.exe	105
PID 824 wrote to memory of 1088	824	RebelCracked.exe	105
PID 824 wrote to memory of 408	824	RebelCracked.exe	106
PID 824 wrote to memory of 408	824	RebelCracked.exe	106
PID 1088 wrote to memory of 800	1088	RuntimeBroker.exe	107
PID 1088 wrote to memory of 800	1088	RuntimeBroker.exe	107
PID 1088 wrote to memory of 800	1088	RuntimeBroker.exe	107
PID 1088 wrote to memory of 800	1088	RuntimeBroker.exe	107
PID 1088 wrote to memory of 800	1088	RuntimeBroker.exe	107
PID 1088 wrote to memory of 800	1088	RuntimeBroker.exe	107
PID 1088 wrote to memory of 800	1088	RuntimeBroker.exe	107
PID 1088 wrote to memory of 800	1088	RuntimeBroker.exe	107
PID 408 wrote to memory of 3188	408	RebelCracked.exe	108
PID 408 wrote to memory of 3188	408	RebelCracked.exe	108
PID 408 wrote to memory of 3188	408	RebelCracked.exe	108
PID 408 wrote to memory of 1136	408	RebelCracked.exe	109
PID 408 wrote to memory of 1136	408	RebelCracked.exe	109
PID 3188 wrote to memory of 3488	3188	RuntimeBroker.exe	110
PID 3188 wrote to memory of 3488	3188	RuntimeBroker.exe	110
PID 3188 wrote to memory of 3488	3188	RuntimeBroker.exe	110
PID 3188 wrote to memory of 3428	3188	RuntimeBroker.exe	111
PID 3188 wrote to memory of 3428	3188	RuntimeBroker.exe	111
PID 3188 wrote to memory of 3428	3188	RuntimeBroker.exe	111
PID 3188 wrote to memory of 3428	3188	RuntimeBroker.exe	111

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Rebel.7z"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3160

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1624

C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
"C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:824
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2908
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3924
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        5⤵
        
        PID:3632
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      PID:1228
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4200
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        
        PID:2368
- C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
  "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3248
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2520
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4800
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1148
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        6⤵
        
        PID:1340
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        5⤵
        
        PID:2028
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5072
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        6⤵
        
        PID:940
- - C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
    "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3748
    - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        5⤵
        Executes dropped EXE
        Drops desktop.ini file(s)
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3228
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2396
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        7⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2536
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        7⤵
        
        PID:3644
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        6⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        7⤵
        
        PID:3204
  - - C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
      "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:824
    - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1088
      - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:800
    - - C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
        
        "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:408
      - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3428
      - C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
        
        "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3704
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        9⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4472
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3756
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        10⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        9⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        10⤵
        
        PID:5096
        
        C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
        
        "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
        7⤵
        Executes dropped EXE
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        8⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        9⤵
        
        PID:796
        
        C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
        
        "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
        8⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        9⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        10⤵
        
        PID:2152
        
        C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
        
        "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
        9⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        10⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        11⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        11⤵
        
        PID:4444
        
        C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
        
        "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
        10⤵
        
        PID:784

C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
"C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
1⤵
PID:3748
- C:\Users\Admin\AppData\Local\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
  2⤵
  PID:4548
- - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
    3⤵
    PID:2204
- C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
  "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
  2⤵
  PID:3528
- - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
    3⤵
    PID:3788
  - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
      4⤵
      PID:2616
  - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
      4⤵
      PID:3584
- - C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
    "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
    3⤵
    PID:4828
  - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
      4⤵
      PID:3188
    - - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
        5⤵
        
        PID:3544
  - - C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
      "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
      4⤵
      PID:940

C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
"C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
1⤵
PID:516
- C:\Users\Admin\AppData\Local\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
  2⤵
  PID:456
- - C:\Users\Admin\AppData\Local\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
    3⤵
    PID:3132
- C:\Users\Admin\Downloads\Rebel\RebelCracked.exe
  "C:\Users\Admin\Downloads\Rebel\RebelCracked.exe"
  2⤵
  PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\318b4e57edc609da352d15f7370bfcdb\msgid.dat

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RebelCracked.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RuntimeBroker.exe.log

Filesize
706B

MD5
9b4d7ccdebef642a9ad493e2c2925952

SHA1
c020c622c215e880c8415fa867cb50210b443ef0

SHA256
e6f068d76bd941b4118225b130db2c70128e77a45dcdbf5cbab0f8a563b867ff

SHA512
8577ecd7597d4b540bc1c6ccc4150eae7443da2e4be1343cc42242714d04dd16e48c3fcaefd95c4a148fe9f14c5b6f3166b752ae20d608676cf6fb48919968e8

Download Submit
C:\Users\Admin\AppData\Local\RuntimeBroker.exe

Filesize
330KB

MD5
75e456775c0a52b6bbe724739fa3b4a7

SHA1
1f4c575e98d48775f239ceae474e03a3058099ea

SHA256
e8d52d0d352317b3da0be6673099d32e10e7b0e44d23a0c1a6a5277d37b95cf3

SHA512
b376146c6fa91f741d69acf7b02a57442d2ea059be37b9bdb06af6cc01272f4ded1a82e4e21b9c803d0e91e22fc12f70391f5e8c8704d51b2435afc9624e8471

Download Submit
C:\Users\Admin\AppData\Local\Temp\places.raw

Filesize
5.0MB

MD5
f81c619cf9a4d914ef742e20e6a8100a

SHA1
1e114d991f25e29c05b41cfbe6088bcb2de0161a

SHA256
9967b19424ce3d47a6794df3cb6fcae6728b4e352c80de74bb228f3f83fa2af2

SHA512
99130e9e3f20b6baefb26868db94c32449360fa8fc1db2db38caff8e7afd948c492603a2f2e9823bcad348b31870e0344832dff1b1877118c2ebdbcab11907a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD80C.tmp.dat

Filesize
114KB

MD5
d9f3a549453b94ec3a081feb24927cd7

SHA1
1af72767f6dfd1eaf78b899c3ad911cfa3cd09c8

SHA256
ff366f2cf27da8b95912968ac830f2db3823f77c342e73ee45ec335dbc2c1a73

SHA512
f48765c257e1539cacce536e4f757e3d06388a6e7e6c7f714c3fce2290ce7cdb5f0e8bb8db740b5899ba8b53e2ed8b47e08b0d043bb8df5a660841dc2c204029

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD81D.tmp.dat

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD820.tmp.dat

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE20F.tmp.dat

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE215.tmp.dat

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE216.tmp.dat

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE227.tmp.dat

Filesize
124KB

MD5
9618e15b04a4ddb39ed6c496575f6f95

SHA1
1c28f8750e5555776b3c80b187c5d15a443a7412

SHA256
a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

SHA512
f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE247.tmp.dat

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
C:\Users\Admin\AppData\Local\a7e66168c532deaba931e9a4083d499e\Admin@SPDEBJWH_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\a7e66168c532deaba931e9a4083d499e\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\Rebel\ReadMe.txt

Filesize
13B

MD5
1c6c20f0c324e98e38272f1245d24e11

SHA1
bbb5dc3a18a532529ec6fa88c86542288dd979f7

SHA256
4ca7414e2aba6d74826403afb6ccbcc1752297a1b61aced8808b75d80d212f2d

SHA512
a30aed5a54580ad73f16ad237f82e2dc99c99d9645d40d1fbdf88a7d6c10c238b6967c011ba46c6084d409e4a37b41983d600146f93cd9250a810b7d784d8246

Download Submit
C:\Users\Admin\AppData\Local\a7e66168c532deaba931e9a4083d499e\Admin@SPDEBJWH_en-US\System\Process.txt

Filesize
4KB

MD5
55b65b92df616ae097b6a947f321cc7a

SHA1
bce49dbc04abdf9af79672422352654a9351d957

SHA256
2d8a6fc6d71d57a85a327ca61f4ac5961179bc936198972446469609fddddad4

SHA512
21b877ebe95f6f28e0590d4eb1757142f9946c38b1f4e8bc9c08552d5fdd7c26c79f850a507a821b1ea21dfe4e9baa45420b641b007b334383d46ea729a5153a

Download Submit
C:\Users\Admin\AppData\Local\b8a4b45740206fef1785745640a2ddb4\Admin@SPDEBJWH_en-US\System\Process.txt

Filesize
63B

MD5
92909ca2fee41e1ebab7b31314924ff7

SHA1
7e280456bc161f5f6e1b04bdf1e68a98149f55d3

SHA256
3ac2152f02d92f01a051c9f4e16f590572c97c2e2bbc436299393b480d439efa

SHA512
956a7cbde3bc149b7d9bece31988a42653b916db017cc9fbd7ad1af903296e97afca8bde7c7e07d623aade9bfae24ae613cd9bde3bc918006eb9c04ae463c271

Download Submit
C:\Users\Admin\AppData\Local\b8a4b45740206fef1785745640a2ddb4\Admin@SPDEBJWH_en-US\System\Process.txt

Filesize
127B

MD5
3458f52c0a869f7471a21f7517eadbea

SHA1
791e73f95f84602c4ae7eabde45ad8b723ddb832

SHA256
555610a229eda6ee5c407dba7b5ab5ff2deb99a86f8c896f385fb68b9d17cc6c

SHA512
50d71209d562349b5ad8903495be39d9f3f05463bc2091894721c93ecc1ae425e5e201c4e16373730096fb8ebde7e586c20bbcc04c91d3477bb2739575163c37

Download Submit
C:\Users\Admin\AppData\Local\b8a4b45740206fef1785745640a2ddb4\Admin@SPDEBJWH_en-US\System\Process.txt

Filesize
191B

MD5
cbccc28cb93882cc9d7d7a234fe56346

SHA1
6efe1cb4fc1d09f7b8b135601b68b84a9f469d57

SHA256
9b07cfbca2af270fb86887a148087bb8bddd8fc2fd74fa875fb8e818acf4b433

SHA512
08e87601d890a5ebda6ce306f8596edb1e128ff22ce7bf8d0bba7a66a0831a8e631b067468bdd6dba0d419184bcf90bd2a5658b564cf6529b294a737aa80f7e2

Download Submit
C:\Users\Admin\AppData\Local\b8a4b45740206fef1785745640a2ddb4\Admin@SPDEBJWH_en-US\System\Process.txt

Filesize
255B

MD5
3a78497c61896f68f6e357712fd7db6f

SHA1
36bdcbb8f6506bf0f57b67863b842eae4ab9f863

SHA256
c170a55ed9bf1940afd7bad3bb848577f41508ae6ccba593803276fb327071ef

SHA512
c7120651e884518a552365feca0c52e9f7a5f51d149fd52b69d5b741ca2b14c4bac28a89ef6ec2bf05988de9791612c819a571fe2f97b341d3833534c044faaf

Download Submit
C:\Users\Admin\AppData\Local\b8a4b45740206fef1785745640a2ddb4\Admin@SPDEBJWH_en-US\System\Process.txt

Filesize
319B

MD5
fc24fa0eb978e20f3bec204e4d08edcb

SHA1
4b64abb293d47433e3c0ca26cd4b6cb2c362cd2a

SHA256
2a5e8e6f084fef7e1bc8d0cd76c0ffc93a19cf01a6a7106f83b7176af822579c

SHA512
3823576e0c00aed191e6575e1484f4f086093d2ce5d93f367d2f56689f5dfabb839d656479ec770a90ee34f2a30455f044b74a4ed1a8596f8f53ec5b87eced1d

Download Submit
C:\Users\Admin\AppData\Local\b8a4b45740206fef1785745640a2ddb4\Admin@SPDEBJWH_en-US\System\Process.txt

Filesize
383B

MD5
a3facecf9ada8aa3ddab4bfee621c957

SHA1
ecf89dc1b7ccd474d2d30eed26335f379969f12a

SHA256
78906d0515acf74231129e33a6bedc4fb55b72161c675c707291731044d6d38a

SHA512
369b7753a743ded8853cdbd9f9a8c4f9f2d709e04399deeb82b737fce4edf062f8fad6341107cba112be59aa7e760248f2dc02964fca1f8c9ded84cd3ea87bfc

Download Submit
C:\Users\Admin\AppData\Local\b8a4b45740206fef1785745640a2ddb4\Admin@SPDEBJWH_en-US\System\Process.txt

Filesize
447B

MD5
ef65da2658092bf9bd51695238940d22

SHA1
31892db8bae6a6f11032e8f5e4eb604057ce2fdd

SHA256
83ec53213d200293690c63def07bca333221a8323cceb94dc174ff3bacce787c

SHA512
149d6d9c4ef1de2f60476b1e0a820f61bcc3b4a72ca64bd031dc8aee26bd9fff1c13e987855bf230ba814e8a7e1e6c2d602134be7e3df46c426369a5afb0a546

Download Submit
C:\Users\Admin\AppData\Local\b8a4b45740206fef1785745640a2ddb4\Admin@SPDEBJWH_en-US\System\Process.txt

Filesize
4KB

MD5
b7bfecd01fdfd6df16a66f761b2dee72

SHA1
2fc1c180788f11e20e2ffac4b1939f25a30d61ab

SHA256
78ca98ed9d49417e1ce68b3db8395f4e5d0214767cefd35767b1d72d5504f081

SHA512
098632460b48979733961c1654b10f65bf3ef2672a579fe2e41d9ea299e499bec2031a6fc9910cfe63916b539271f1953b09def3ea9bdc571c69ab84c9c2eea7

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Directories\Desktop.txt

Filesize
531B

MD5
704b99bb837cec5e6c4dc69e45a19140

SHA1
75eb84aef1f63bdca98589e7ffae760946034d3a

SHA256
6c966d718b136b6508ab59ee8b4275aaf19547a0a8ca5d73df43b857d5db4bab

SHA512
69f926682cc9fa5007175eff9aebca1b63d1ff3f7b7cfe8f17d61f6c2184d254a4e9504cd1618dcd5ed4e6116adb25a2da972cbbb4651792d073c454207744ce

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Directories\Documents.txt

Filesize
632B

MD5
ce6b59bbdc0b6ff4806a3bd7a704857a

SHA1
e3a9e41a9dd9027071a99cf66a02e9cdecbc46e0

SHA256
1549b897027f6c1d37a3d1d24486183f8b10bf208df0cb3f8d00024b9f4bd6e6

SHA512
d4e2780dc8e12288f21fb9b6430a7691168697fb58e73bb43a3abcf7dfc1e7bf3d5b1c95405480d27bd20c1fbb5d56ba6cb291266cdb198456bb57728cfc45bc

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Directories\Downloads.txt

Filesize
789B

MD5
162490b747bc385d6c2f42729ed765d6

SHA1
5058f5cadc8213c0ca7fda3e02e569a7067c68b4

SHA256
a0394071f8b4bb370b05c19cf08a76386377245aef6bf0afb52c3e845d173273

SHA512
61721a4a4a386bea9f2004e98064a76083221455d8f2e59871a57a70233d02624bfc29aa1621ebf29279f050be53e2ccecf440eab50b06bb631c4b65259ee6a9

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Directories\OneDrive.txt

Filesize
25B

MD5
966247eb3ee749e21597d73c4176bd52

SHA1
1e9e63c2872cef8f015d4b888eb9f81b00a35c79

SHA256
8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

SHA512
bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Directories\Pictures.txt

Filesize
726B

MD5
a5f984e42a6915d23ad20f13ff9720df

SHA1
173af73cf483efe59006e95309c72688110e1de0

SHA256
d6ef4b9afed28e145a8012d77d3dfbe78114c55c60830ce08bd7cef231ac667b

SHA512
c9e70b60be1d09c3765f2c47b41275977225d868f45dd5118dd58db9a0440a6e5fce08d4e0824533e6401a21f0b5a057903ecc9312e0b1eee73caf78d122e984

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Directories\Startup.txt

Filesize
24B

MD5
68c93da4981d591704cea7b71cebfb97

SHA1
fd0f8d97463cd33892cc828b4ad04e03fc014fa6

SHA256
889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

SHA512
63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Directories\Temp.txt

Filesize
3KB

MD5
73a0027e774adc7fcb9caa810d3752a0

SHA1
2900d94282a6443c68002c994086eebd579fadcf

SHA256
d0e8ff624aacd3abc1240bed28a122b1562ee5f5554208bceedaa0fc59b99e7d

SHA512
a8adca49acf3555cd409711cf9caca0e1717040fb92bcff99299ce5322eb29a4e701b6dcb699cdadfcd471666c55ab2cb1ea5bc5aaa2297244639c53f5b1b46e

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Directories\Videos.txt

Filesize
23B

MD5
1fddbf1169b6c75898b86e7e24bc7c1f

SHA1
d2091060cb5191ff70eb99c0088c182e80c20f8c

SHA256
a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

SHA512
20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini

Filesize
282B

MD5
9e36cc3537ee9ee1e3b10fa4e761045b

SHA1
7726f55012e1e26cc762c9982e7c6c54ca7bb303

SHA256
4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026

SHA512
5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini

Filesize
402B

MD5
ecf88f261853fe08d58e2e903220da14

SHA1
f72807a9e081906654ae196605e681d5938a2e6c

SHA256
cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844

SHA512
82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini

Filesize
282B

MD5
3a37312509712d4e12d27240137ff377

SHA1
30ced927e23b584725cf16351394175a6d2a9577

SHA256
b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3

SHA512
dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini

Filesize
190B

MD5
d48fce44e0f298e5db52fd5894502727

SHA1
fce1e65756138a3ca4eaaf8f7642867205b44897

SHA256
231a08caba1f9ba9f14bd3e46834288f3c351079fcedda15e391b724ac0c7ea8

SHA512
a1c0378db4e6dac9a8638586f6797bad877769d76334b976779cd90324029d755fb466260ef27bd1e7f9fdf97696cd8cd1318377970a1b5bf340efb12a4feb4a

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini

Filesize
190B

MD5
87a524a2f34307c674dba10708585a5e

SHA1
e0508c3f1496073b9f6f9ecb2fb01cb91f9e8201

SHA256
d01a7ef6233ef4ab3ea7210c0f2837931d334a20ae4d2a05ed03291e59e576c9

SHA512
7cfa6d47190075e1209fb081e36ed7e50e735c9682bfb482dbf5a36746abdad0dccfdb8803ef5042e155e8c1f326770f3c8f7aa32ce66cf3b47cd13781884c38

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini

Filesize
504B

MD5
29eae335b77f438e05594d86a6ca22ff

SHA1
d62ccc830c249de6b6532381b4c16a5f17f95d89

SHA256
88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4

SHA512
5d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\System\Process.txt

Filesize
2KB

MD5
e54259e1092ac5496798a8e8227126e2

SHA1
ff62633903dd958b4c5e402e1e12065025599a23

SHA256
7e752b53062cdc8566736cd5397a0a03c44cc744aee5753a7cdc62dc1e95a9b0

SHA512
2456875c8ed7baf8a42d2d0e2b33a9146259d25e0fe5388652a4dd3683c345e9684521ff348bf9a6a034f98e7cac5b0aa0d5f19218cc6e6ac4359c489d539fca

Download Submit
C:\Users\Admin\AppData\Local\cd006780553172b93a67b1ecc2634024\Admin@SPDEBJWH_en-US\System\Process.txt

Filesize
4KB

MD5
2a5f3eb6af46954152a62fc96189e358

SHA1
7fabdacf1edd4aff744e260d258f5c91df7eb6d8

SHA256
f5b1d99bfef071697a6e8c96e8b98be7a72c4c4c9696054258a914a2d32421eb

SHA512
b08663e67d9a23efe3807857957e86b00f0d3c9ebb2e576f88d2343fca62f0b145c2755088bc36bcc1d4fde017114032c6159117977e54a45f8fc21da518333f

Download Submit
C:\Users\Admin\Downloads\Rebel\RebelCracked.exe

Filesize
344KB

MD5
a84fd0fc75b9c761e9b7923a08da41c7

SHA1
2597048612041cd7a8c95002c73e9c2818bb2097

SHA256
9d9a79f4ae9bf7a992945f6c06c5bec642c05e4e828217c50255dabfa3677006

SHA512
a17f1144a0e3ce07c7ed6891987c5b969f291e9991442c33750028d35e2194794e8a649c397e8afc9f8ce19d485c453600c75cab4fcead09e38414d85819251a

Download Submit
memory/2332-53-0x0000000005BB0000-0x0000000006154000-memory.dmp

Filesize
5.6MB

Download
memory/2332-57-0x00000000056A0000-0x00000000056AA000-memory.dmp

Filesize
40KB

Download
memory/2332-56-0x0000000005740000-0x00000000057DC000-memory.dmp

Filesize
624KB

Download
memory/2332-55-0x0000000005390000-0x00000000053DA000-memory.dmp

Filesize
296KB

Download
memory/2332-54-0x0000000005600000-0x0000000005692000-memory.dmp

Filesize
584KB

Download
memory/2332-51-0x0000000000550000-0x00000000005A8000-memory.dmp

Filesize
352KB

Download
memory/3228-803-0x0000000006550000-0x000000000655A000-memory.dmp

Filesize
40KB

Download
memory/5020-52-0x00007FF818340000-0x00007FF818E01000-memory.dmp

Filesize
10.8MB

Download
memory/5020-37-0x00007FF818340000-0x00007FF818E01000-memory.dmp

Filesize
10.8MB

Download
memory/5020-35-0x00000000008A0000-0x00000000008FC000-memory.dmp

Filesize
368KB

Download
memory/5020-34-0x00007FF818343000-0x00007FF818345000-memory.dmp

Filesize
8KB

Download
memory/5080-58-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5080-70-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download