stormkitty | 37fae2ac78281be79821e625ba969bcd0c11336c56e68b71b5fbb284e9f8fd60

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpyroidRatv8.5OriginalCracked.exe
Size

55.7MB
MD5

f2a9d485cc841bbd44543973e3739c05
SHA1

53235a653bfc5822693e9adfdea01e1164909df9
SHA256

37fae2ac78281be79821e625ba969bcd0c11336c56e68b71b5fbb284e9f8fd60
SHA512

4de26d0f38868934182e0ef1fc3270990a66eba2c6af340490f55e4bf7f04696f91f93f62457191031d468e34c0ec5f0ba4995df63275dbf77254b1a7d2be56d
SSDEEP

786432:JrXC9Vqv1tRgvtgkG8iAl0dYyBGpjKElxsdo/AG9Lqxlwy+WpL15Q7HxJ1KP3u5C:JjC9VvtdG8iV6jKmqdo/ry+gXwIuqxZ

Score

10^/10

stormkitty collection discovery lateral_movement spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00090000000120fe-6.dat	family_stormkitty
behavioral1/memory/2908-15-0x00000000002B0000-0x0000000000306000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Remote Service Session Hijacking: RDP Hijacking 1 TTPs 1 IoCs

Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

lateral_movement

RDP Hijacking

T1563.002

pid	Process
1964	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2908	rl payload.exe
1028	test rdp.exe
2452	Spyroid Rat V8.5 Cracked.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rl payload.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rl payload.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rl payload.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Desktop\desktop.ini	rl payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Desktop\desktop.ini	rl payload.exe
File created	C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Downloads\desktop.ini	rl payload.exe
File created	C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Pictures\desktop.ini	rl payload.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	api.ipify.org
28	api.ipify.org
4	freegeoip.app
8	freegeoip.app
19	api.ipify.org
20	api.ipify.org
21	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rl payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test rdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	rl payload.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rl payload.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2580	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	test rdp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	test rdp.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2908	rl payload.exe
2908	rl payload.exe
2908	rl payload.exe
2916	powershell.exe
1796	powershell.exe
1964	powershell.exe
2908	rl payload.exe
2908	rl payload.exe
2908	rl payload.exe
2908	rl payload.exe
2908	rl payload.exe
2908	rl payload.exe
2908	rl payload.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	rl payload.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	1028	test rdp.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2908	2744	SpyroidRatv8.5OriginalCracked.exe	30
PID 2744 wrote to memory of 2908	2744	SpyroidRatv8.5OriginalCracked.exe	30
PID 2744 wrote to memory of 2908	2744	SpyroidRatv8.5OriginalCracked.exe	30
PID 2744 wrote to memory of 2908	2744	SpyroidRatv8.5OriginalCracked.exe	30
PID 2744 wrote to memory of 2908	2744	SpyroidRatv8.5OriginalCracked.exe	30
PID 2744 wrote to memory of 2908	2744	SpyroidRatv8.5OriginalCracked.exe	30
PID 2744 wrote to memory of 2908	2744	SpyroidRatv8.5OriginalCracked.exe	30
PID 2744 wrote to memory of 1028	2744	SpyroidRatv8.5OriginalCracked.exe	31
PID 2744 wrote to memory of 1028	2744	SpyroidRatv8.5OriginalCracked.exe	31
PID 2744 wrote to memory of 1028	2744	SpyroidRatv8.5OriginalCracked.exe	31
PID 2744 wrote to memory of 1028	2744	SpyroidRatv8.5OriginalCracked.exe	31
PID 1028 wrote to memory of 2916	1028	test rdp.exe	32
PID 1028 wrote to memory of 2916	1028	test rdp.exe	32
PID 1028 wrote to memory of 2916	1028	test rdp.exe	32
PID 1028 wrote to memory of 2916	1028	test rdp.exe	32
PID 2744 wrote to memory of 2452	2744	SpyroidRatv8.5OriginalCracked.exe	34
PID 2744 wrote to memory of 2452	2744	SpyroidRatv8.5OriginalCracked.exe	34
PID 2744 wrote to memory of 2452	2744	SpyroidRatv8.5OriginalCracked.exe	34
PID 2916 wrote to memory of 1484	2916	powershell.exe	35
PID 2916 wrote to memory of 1484	2916	powershell.exe	35
PID 2916 wrote to memory of 1484	2916	powershell.exe	35
PID 2916 wrote to memory of 1484	2916	powershell.exe	35
PID 1484 wrote to memory of 2868	1484	net.exe	36
PID 1484 wrote to memory of 2868	1484	net.exe	36
PID 1484 wrote to memory of 2868	1484	net.exe	36
PID 1484 wrote to memory of 2868	1484	net.exe	36
PID 1028 wrote to memory of 1796	1028	test rdp.exe	37
PID 1028 wrote to memory of 1796	1028	test rdp.exe	37
PID 1028 wrote to memory of 1796	1028	test rdp.exe	37
PID 1028 wrote to memory of 1796	1028	test rdp.exe	37
PID 1796 wrote to memory of 316	1796	powershell.exe	39
PID 1796 wrote to memory of 316	1796	powershell.exe	39
PID 1796 wrote to memory of 316	1796	powershell.exe	39
PID 1796 wrote to memory of 316	1796	powershell.exe	39
PID 316 wrote to memory of 484	316	net.exe	40
PID 316 wrote to memory of 484	316	net.exe	40
PID 316 wrote to memory of 484	316	net.exe	40
PID 316 wrote to memory of 484	316	net.exe	40
PID 1028 wrote to memory of 1964	1028	test rdp.exe	41
PID 1028 wrote to memory of 1964	1028	test rdp.exe	41
PID 1028 wrote to memory of 1964	1028	test rdp.exe	41
PID 1028 wrote to memory of 1964	1028	test rdp.exe	41
PID 1964 wrote to memory of 2168	1964	powershell.exe	43
PID 1964 wrote to memory of 2168	1964	powershell.exe	43
PID 1964 wrote to memory of 2168	1964	powershell.exe	43
PID 1964 wrote to memory of 2168	1964	powershell.exe	43
PID 2168 wrote to memory of 2388	2168	net.exe	44
PID 2168 wrote to memory of 2388	2168	net.exe	44
PID 2168 wrote to memory of 2388	2168	net.exe	44
PID 2168 wrote to memory of 2388	2168	net.exe	44
PID 1028 wrote to memory of 1936	1028	test rdp.exe	46
PID 1028 wrote to memory of 1936	1028	test rdp.exe	46
PID 1028 wrote to memory of 1936	1028	test rdp.exe	46
PID 1028 wrote to memory of 1936	1028	test rdp.exe	46
PID 1936 wrote to memory of 2580	1936	cmd.exe	48
PID 1936 wrote to memory of 2580	1936	cmd.exe	48
PID 1936 wrote to memory of 2580	1936	cmd.exe	48
PID 1936 wrote to memory of 2580	1936	cmd.exe	48

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rl payload.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rl payload.exe

C:\Users\Admin\AppData\Local\Temp\SpyroidRatv8.5OriginalCracked.exe
"C:\Users\Admin\AppData\Local\Temp\SpyroidRatv8.5OriginalCracked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\rl payload.exe
  "C:\Users\Admin\AppData\Local\Temp\rl payload.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\test rdp.exe
  "C:\Users\Admin\AppData\Local\Temp\test rdp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" net user ThanksEgalsa ThanksEgalsa /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\SysWOW64\net.exe
      "C:\Windows\system32\net.exe" user ThanksEgalsa ThanksEgalsa /add
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user ThanksEgalsa ThanksEgalsa /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" net localgroup administrators ThanksEgalsa /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\SysWOW64\net.exe
      "C:\Windows\system32\net.exe" localgroup administrators ThanksEgalsa /add
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:316
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators ThanksEgalsa /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:484
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" net localgroup "Remote Desktop Users" ThanksEgalsa /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\SysWOW64\net.exe
      "C:\Windows\system32\net.exe" localgroup Remote Desktop Users ThanksEgalsa /add
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup Remote Desktop Users ThanksEgalsa /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp561C.tmp.cmd""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 4
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2580
- C:\Users\Admin\AppData\Local\Temp\Spyroid Rat V8.5 Cracked.exe
  "C:\Users\Admin\AppData\Local\Temp\Spyroid Rat V8.5 Cracked.exe"
  2⤵
  - Executes dropped EXE
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Service Session Hijacking

T1563

RDP Hijacking

T1563.002

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rl payload.exe

Filesize
320KB

MD5
dfa05cfd683034da7b16c32b76a6619c

SHA1
efe6fa32ba1c53155ed6acc32de614a3ca8cadff

SHA256
0c67544fc30499491749cc9cda184c4af9e61bf16dd697b402ad936df9e182f3

SHA512
cb966cf5dba9b32950b0f96e62dedcaeb1de22ee41a010f247f4e3ac2be602075bcd76d71a431164cee649ba4e91319a4dad41f553260ecffc7c02905d5889f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\test rdp.exe

Filesize
8KB

MD5
6019493627e029531ac13da62d870719

SHA1
46d7c20fd308c376e40060ee455743f7b913f7af

SHA256
0b85f47949effe436c598cddf1ddabf1b952eac63009d25fdee34f864bc10569

SHA512
a125613e5718dea3499e5a1b4b13dc48eef6b5bbc33462ae2a6cda2efd129992fec09ed799be738048c226e4f1743e4cc298236c2c9d2acf41c8301830a328da

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp561C.tmp.cmd

Filesize
154B

MD5
e719f4f4e9b48b1042fa684c85287f55

SHA1
9fdc2568c26edda40bd5570f85d25a45595a918b

SHA256
d7f9ba246cf4e4fd107728f76afcdbbbe87ac4727c84a08fb30f9bff2a4c316b

SHA512
76496f284f0c8abbed0585acfe37a045f4861efe3f20985409ff75b3a3708632f7c3c6e8f8f897111caf0bf01ae09eba172969eb0b0fdd6fc950420a0361d569

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
0b588179a16a11f2d75004467abe2bff

SHA1
9f427bf0df1f6df931270b056198d5b1c92baee8

SHA256
02b80cccafda51c30e38936f95014b01bbf03ba5452583025810118d6a62272f

SHA512
65d37461f5531ebe3ab2bfbe982d9e2f58dbcc45215969ce135d6c0a52fa972f36d584134fd4bd252395d9721ee69e0f2ed5749e49e7eed0e72d50df430c3be1

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Desktop\DismountPublish.xlsx

Filesize
10KB

MD5
544ecb0e0cedb765bdcaf32159ae654f

SHA1
262c5d7ca655ed1bbbb3f60b9651972aabc8b084

SHA256
54b60720b6383da68b06a49f1dd052f6406a2128cc1da236c8c89a3d137b2995

SHA512
df85b392043a3dd309012411c64295a8b6fbff48fc8fcd50537c41bae6a1ce0a4597a8937705ffaad483886b09bcc603fc8e5dd6ce53cf99c251145e0215f219

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Desktop\ResetExpand.rtf

Filesize
895KB

MD5
f3c8e1d9fdb95e2bf387ea9a14e316a9

SHA1
b0d87d9eef27c5586a6b7ed13d099c81524f6e99

SHA256
d202201fad7e2aa3d0cfa62fe5b81fb3193a15f5a77fa551f4f7b8876632c906

SHA512
519f812441f880ce84fd92b790ddc88df7c56ac5f93718756413b69ad5520dd2bb46a08e4425a1dc7f8993323fa439c8a515514f180f59550c64428a731935b9

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Desktop\SkipConvertFrom.txt

Filesize
561KB

MD5
865688004cdde90ad2f6a465c3dcd57a

SHA1
34afc29542ccd0f111dc3700859a789af2a944e7

SHA256
f8f068a58233fc35a4fde31120303d8d36692dc6fee0349f0323b52afdea6bb3

SHA512
56614d559bf944db583cee2972b257aebb1d1c614d75c5839a72b08f149adce216a278046f7e751d11073bc3e138761b6ede8f2c271a4c58e71ffbb796b567a9

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Documents\AddUpdate.ppt

Filesize
407KB

MD5
0221797aea340df8d524b70a83595b43

SHA1
74b2f5ec045bd0eac09d2bbfeb6523d6dbbc1f36

SHA256
ce0f17c4f79c40e7038840e9aeb2407effb86c0261e9fb5c351a2f058e0bff7d

SHA512
2c9a8fa82953ab0a2baa21af50cdc4a06c8784dfa1d38f69f6e6f7c3aff3a52c94f10e0ef6adcadc5f47ee6f76198b60a06043fde236dee3a59b4be924f04b3e

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Documents\BackupDisable.doc

Filesize
579KB

MD5
ee815ab3368a2dfb752c3b6ed632665c

SHA1
02da22b85196b40a04072c19ecb7bf7d141204c0

SHA256
6bfc161e7e7cc01df8f217bde20b05f443fd2adef93712ed61c222f9b3e40f5c

SHA512
b5d048a4c30e4a5db8d2d9f8581aaf8c6d04ae0569759c90213f289be3fb88de2bab77ca74729089fa11b24a7480e0a7e1b9fe7a4337c55fa1707d1d19b8d936

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Documents\ConvertPublish.rtf

Filesize
250KB

MD5
dea64c71dd2b939af90de3e88ccd9123

SHA1
c120c26c04afdd06794b0a0a511ccc9ad787b109

SHA256
76cf47bc7623874e556a74b79908164919e48b4b2d3b883c79b4e72752146a8b

SHA512
9288b87c016e5a84f400aa7df745bf0f9d6387af4efb9021f404f1178499003870e9c0533f3194eafe85c95febbfd8ce1d8bf9fb1ea98d44d61cdb783a04edd0

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Downloads\SetUnregister.jpeg

Filesize
631KB

MD5
a4dfb825139d656d57b2d4b4aeaa9de9

SHA1
98c31438e9495e4da1f82435999efb9e9a03528c

SHA256
2975551961400db857c0444d73ac68d210a558a6110bb39c11c251b53e56823e

SHA512
d5e4c90048e20816347fc5848236a2816cba8d021e8b6ec61245d9ee58fa27c65b18e6ad86f9747caa19e4e85ce45888c01a85097a174a2f860d690bfe5baddf

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Downloads\UndoRead.pptx

Filesize
460KB

MD5
acfba740284e2cc6d59daea78291bb09

SHA1
d24680cdac3412266995d14ce3c2ee79d4ba5222

SHA256
f70f9065bdd746f9e9b9c6da83d625be6ca661193bd2d89012a060c30a76e085

SHA512
491f8d4a5487f0b92fdbeb6ba6c3f2a15c9922e8107ed8076e50d3ec51ab4a9755874c4fefa6a36aabbf62d8ecb1f8ec9337e33f727d0dde6d956bc1a2a101b8

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Pictures\AddSelect.jpeg

Filesize
456KB

MD5
4eb95c3db1212de416c691a1f0447b10

SHA1
cc86336459b48beb08f9b29a87354921b404a830

SHA256
58c9d4cb842140210afd92c97eb67b583a6ce41486abcf05fe0e946735998580

SHA512
f8c8de690aa84249c48bee0351240bb439b0c9e11c0de72a63bd7740bc9aba49b41cd3b906ec1e9f00f60f12f02881a2b6ada31f042398eb865030df7a62b90e

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Pictures\EnableExpand.jpeg

Filesize
360KB

MD5
d0177a12596a86fbb9e2116f648c940c

SHA1
2564af0c2db80ac9cec454aa7e3b2a24f2492928

SHA256
d158fb48bec3e514aa43633738acddc4cf59ecb89a70aa7268d83d4bddac88ec

SHA512
36e1c7e120042e420ef9d4f62bfae84a7ac648632ef6d02eddb871d8bd9ba1b867fc994f7edb9411509df3d76df0336da5843a6815edc38b86573792c92e14e8

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Pictures\JoinClose.jpg

Filesize
264KB

MD5
e5fac5e0d3a63d8512de8f2d774bf2c7

SHA1
274f7e104d257c8f1d33bdb07c08704383cfb015

SHA256
6a70176d2c948875a370561c88eefcf3bf746738c12bbc501bd427e09a551af8

SHA512
d13e5dc6611eab38221804c925cd59c251167bc46059eaf0a9464d296da6fa7d33660bbe6d36b0213668668f391fee95e98040c31ac1db15e8bc890d054a3416

Download Submit
C:\Users\Admin\AppData\Roaming\PIDEURYY\FileGrabber\Pictures\ReadApprove.png

Filesize
252KB

MD5
69cc90b560b09b12cb6e2ae383ff09cb

SHA1
f5e93cc78ec62f115d7d6bba673b1bf06a08a8ea

SHA256
e56bf99edcd39f5fbf76039593c832b353dad918414f6fa91996b99b9428b4bd

SHA512
a318252536f95c83224bfdf60fbeaf08cef9c622cf422a8074e0d0681cb2c6b7394393ded770d3e147022ba5cde23aa7e84e2725806e96db1302023e4f02dae9

Download Submit
memory/1028-14-0x0000000000DC0000-0x0000000000DC8000-memory.dmp

Filesize
32KB

Download
memory/1028-18-0x00000000742DE000-0x00000000742DF000-memory.dmp

Filesize
4KB

Download
memory/2452-52-0x00000000000D0000-0x00000000042E0000-memory.dmp

Filesize
66.1MB

Download
memory/2744-1-0x0000000000BD0000-0x0000000004392000-memory.dmp

Filesize
55.8MB

Download
memory/2744-0-0x000007FEF5963000-0x000007FEF5964000-memory.dmp

Filesize
4KB

Download
memory/2744-17-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

Filesize
9.9MB

Download
memory/2744-51-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

Filesize
9.9MB

Download
memory/2908-15-0x00000000002B0000-0x0000000000306000-memory.dmp

Filesize
344KB

Download
memory/2908-53-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-223-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-251-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download