hackbrowserdata | d2605d6c7df64c9cc45fb58cefeb196489812e8e7e607556d4817aecb61681fd

Analysis

max time kernel
96s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zjrtdbt3.exe
Size

806KB
MD5

707b311ccf5b3f5d49e422e447c4336b
SHA1

157b280bf0e4d55118221da9cbe9d5739204e050
SHA256

d2605d6c7df64c9cc45fb58cefeb196489812e8e7e607556d4817aecb61681fd
SHA512

c6df8c0a465d9e5fe84b3b2198cfe6a921e0b177902a49aa76e127a56b989f8d35c3adc6733973cbfe13ac10bba9bf3eac0cb182ec28be797c0d48af94c74376
SSDEEP

24576:Y2Q9NXw2/wPOjdGxY7kqjVnlqud+/2P+Aey:YTq24GjdGS7kqXfd+/9Aey

Score

10^/10

hackbrowserdata discovery infostealer persistence privilege_escalation pyinstaller spyware stealer

Malware Config

Signatures

An open source browser data exporter written in golang. 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c91-184.dat	family_hackbrowserdata

HackBrowserData
An open source golang web browser extractor.
infostealer hackbrowserdata
Hackbrowserdata family
hackbrowserdata
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	zjrtdbt3.exe

Executes dropped EXE 3 IoCs

pid	Process
4500	tkstt.exe
1972	tkstt.exe
4928	bsrtt.exe

Loads dropped DLL 38 IoCs

pid	Process
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe
1972	tkstt.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1728	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0007000000023c8b-21.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zjrtdbt3.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3904	cmd.exe
4204	netsh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	zjrtdbt3.exe
Token: SeDebugPrivilege	1728	tasklist.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4500	3196	zjrtdbt3.exe	94
PID 3196 wrote to memory of 4500	3196	zjrtdbt3.exe	94
PID 4500 wrote to memory of 1972	4500	tkstt.exe	96
PID 4500 wrote to memory of 1972	4500	tkstt.exe	96
PID 3196 wrote to memory of 4928	3196	zjrtdbt3.exe	97
PID 3196 wrote to memory of 4928	3196	zjrtdbt3.exe	97
PID 3196 wrote to memory of 1728	3196	zjrtdbt3.exe	99
PID 3196 wrote to memory of 1728	3196	zjrtdbt3.exe	99
PID 3196 wrote to memory of 1728	3196	zjrtdbt3.exe	99
PID 3196 wrote to memory of 3904	3196	zjrtdbt3.exe	101
PID 3196 wrote to memory of 3904	3196	zjrtdbt3.exe	101
PID 3196 wrote to memory of 3904	3196	zjrtdbt3.exe	101
PID 3904 wrote to memory of 4204	3904	cmd.exe	103
PID 3904 wrote to memory of 4204	3904	cmd.exe	103
PID 3904 wrote to memory of 4204	3904	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\zjrtdbt3.exe
"C:\Users\Admin\AppData\Local\Temp\zjrtdbt3.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\tkstt.exe
  "C:\Users\Admin\AppData\Local\Temp\tkstt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Users\Admin\AppData\Local\Temp\tkstt.exe
    "C:\Users\Admin\AppData\Local\Temp\tkstt.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1972
- C:\Users\Admin\AppData\Local\Temp\bsrtt.exe
  "C:\Users\Admin\AppData\Local\Temp\bsrtt.exe" -b all -f json --dir browsers
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\SysWOW64\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C netsh wlan show profile
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT.5

Filesize
16B

MD5
9f36605efba98dab15728fe8b5538aa0

SHA1
6a7cff514ae159a59b70f27dde52a3a5dd01b1c8

SHA256
9c283f6e81028b9eb0760d918ee4bc0aa256ed3b926393c1734c760c4bd724fd

SHA512
1893aa3d1abcf7f9e83911468fa2eeb2ad1d7e23f4586bd6c4d76f9f96a645c15e63e44da55700347165e97b6ac412e6d495b81c3da9faa61d617c7a71a7404c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Local Storage\leveldb_7.temp\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\12272_ReceivePush.png

Filesize
746KB

MD5
2b03d0773e635163f31c7595b321581f

SHA1
014e8d10937c5f1537cc8004d9dc0ca91c7fa3af

SHA256
b7ceae945a6b94c53b422ada5282a60a7a09dd4760bc9d44ce99075c78a8a0fa

SHA512
85c09a535afcd77bd0d77e9868cebe1d1cbcbecb4eeb16a5424143adf2a611461f0cfbcd644a242bd7fd1a6adf8423493c376096b8aad9d97e8983970233dd29

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\21282_SkipLock.jpeg

Filesize
666KB

MD5
a8f0983d66932c787cc02a8e8d879da6

SHA1
b2a7b2695c4bb1a3d989ad7926ddc3b352529d9f

SHA256
c731a964e87dd9c38ec7638eec40b1f90c98f7719fc1731dfda5c4961674bfef

SHA512
1812f3cdfcddf1f1d300bf130929960de4dff44f7964a3d1096985a033c7608ca4a4c242f26c627c76804ec20be29bbc55460cda61e1fcda780ca13611b2fca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\21500_ReadMount.jpg

Filesize
400KB

MD5
22c78df474bcde1d4a369fbedc6c8432

SHA1
a90f6f36cff3ddc488d116f63fbaeb2f55516bac

SHA256
bede181ca774da005b142f423c8964fca052a404340522641071a9eae47c332c

SHA512
a79f491e24b81c7f0d1da3eade1966225803c70668d51c3593b87ffd537d518cbf3adeca37340f196b6282d5499a77b166b3ea956cefbcf8b197a59f4fef5284

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\25211_DisconnectBackup.ods

Filesize
666KB

MD5
98fb0601c5c9a9d9cee20feb21947b17

SHA1
22cc0e12d1f1d5bd0c86a8c4e2f327e2a634b2c7

SHA256
3fcda1b198adc98cfbc0b09c3f339896a8946b2676cce8444850a7c67b0ae73a

SHA512
08d26a1ffd02f8b4ab6926945191bfed7aa4943fc14e3ed7d1dfe795c3daf5b1fc2db6622ec9cdcf7bb536ea8c8400e6aed505b208df243ea41021fc3cee4079

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\28570_DisconnectInstall.png

Filesize
284KB

MD5
4fff41f08a7a4708679b5039dd55a13a

SHA1
160da050b3f23828ecefe01fa84454cab72feda5

SHA256
eb88952f97920a05459a9959282b45b868e5dae5582d6aa6fadb18be521555ba

SHA512
810a9ddaff3db27123e04d37b38509086c618325a6d5e97e544a8c94e4bb6a07eb89e01921edaaea5a734ee0c94519c24762b3a042a5b71a0f8b389f64c58ed2

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\31056_ResumeWrite.potm

Filesize
1.3MB

MD5
86d4794b142bad3b0209448b69bc0b1a

SHA1
0ac929162da771946a80e9e04b3bdba8d9a8d322

SHA256
a2df74976f2874c122bdf94dcee9553a89baaf882ec9b2b20b12d9de69be4de6

SHA512
cda84225af974784e7cba7d8a693dc9da164ef1a6521265b96cf44d789aee5ea01f554cf61e9724500a24f5628910c69498d3f55f69c2d5bfcd333650c64dc58

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\35191_ImportShow.csv

Filesize
893KB

MD5
4c2ad71a3cad326c89381eeb87b055fb

SHA1
3a1f31593108e63a6925aa38c993335680002ed9

SHA256
0d93f9e39f452772d1ddd17eabba3bc24f69d767ee1796f001d8e4b72e1409fe

SHA512
ffd3a2d21a8f5276708f6e090aa7273a198fa7e1abaebece850c4779579514f1dbaa45bbf19b0200c0402335dd1e010f2bcdfb4aa8e4476a0c196007e918ff46

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\42284_BackupSubmit.eps

Filesize
398KB

MD5
249a342306784c6190bf584e1a5bf06c

SHA1
698cb1cb33c4414c3904755fd1dc2ca6b281ab1b

SHA256
c0b4d4ae8d33197bea599fa3c013086717af8673f1bdc32d6b9433c78ca991b6

SHA512
dbb05e514645c92e0af1932a3cb417a230540a6e61d64326adb6f3c6d50d6b50fdd9de8ffa98685ca829e37f485c31858af8c346da46ce7edcd83fd739976589

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\47680_RequestResize.doc

Filesize
690KB

MD5
694db4451dcc23d9eb348569726a3f10

SHA1
627127153f99bda12d786b9805833f1441b62768

SHA256
ded4996e9b5a086b668b6538fe89553629eb90c456498d14f81b5b8cf170f0f7

SHA512
fdb46ea3de12773ca085f132ce389686d0d2b9245ecc186b99baceb445c4a640dd5f0f9ef116698a91ad42ee8175854b62c98bcf101b4846368456edd8dd0860

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\50677_BackupReset.xht

Filesize
336KB

MD5
0f5e6eb49688298b2539cef6b7b6c40f

SHA1
91c36ea97e1db0ea42f7648a7a22d8b9d3bc2897

SHA256
d09bf0b12216a1aab85bf33c1c817296a29b96730e962243db8202c3babc9574

SHA512
487856ecad6a7eedca0bbabd66eea38ad50c9b09336c3ccf52d46e1d3499e1a5b6ca9766d936344f03bfaa171b40ff9bc776377afbdf64038898d409c9406340

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\52360_UnprotectPop.jpg

Filesize
593KB

MD5
dad008cf88e3699d5534c6e59a73f746

SHA1
99e3beb3d0d1cdd154b39151853b0cce39871771

SHA256
af263b23a2d4f36f7cae1121eccdf0088b5556458219ee74a3b54a06ec0a3197

SHA512
78f47a1d32775d4639ebdcec1d77ed3bba7f6f5e8a48688a9430ed3c74892660186b0a26e3a197e4ab12fdf40ef49142de77c2d70394de99f67716d501b3aa7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\58030_SplitRead.csv

Filesize
239KB

MD5
56ad85cb11880dd0baaaafd15d369ba8

SHA1
2b1ae5ecd0a2a0c579c014b8ae2e6876e8860cd5

SHA256
4d6200632bda781f7e93e8e5ccb6915af690875f9c7dfbf3719c7d1698ef3f25

SHA512
94a06ab39528f592c926dd29b464a11f3ed7214ed326a3a62bc65c5430555ca5f40a959743be2e39febbf895534023cf2db3b033671c63c2293bdc76a2712192

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\61066_SwitchSplit.jpeg

Filesize
826KB

MD5
a40de83b0f089baed0c2ab6425876faf

SHA1
484a8e26888dca39548056668f9fdf37218d59eb

SHA256
ca56b3299a8558473364f0bc7ba4f0ae550f0c251b096955c17b0d3a16f646cd

SHA512
8702ca50494b57196173b26aeb1a0e7b167b14755da1a87f46d63a1be1978aee9085d238160cbda4f6722962856d83666f659fbb2d2fee241f2c24fd852fdb44

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\66432_InvokeFormat.xls

Filesize
545KB

MD5
a962bf2ad35623b3151104c5f158308a

SHA1
1c4360d6422b4e58703d1e14198ad8e852bd2ace

SHA256
8284fa0f72b624cad9f7d42c9c9ecb19535510c569237ccb5011f5a7f98d02f9

SHA512
01d7d9b1af394a40ce493ddbcb52c4c957765760410923d50f2b6a168c5c0c6faff3c18444ae3249968abdde935a1c6ff6e45309b09145e251fdc4f554850bb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\69071_ExpandExit.mp4

Filesize
981KB

MD5
2e6de205f978bac10104f81e5c0660eb

SHA1
87498614945ac473f8f11c96ee82fce0798093b0

SHA256
6aa7a6a74a353e27b96b798f79a2f37e3c2b865a847972a86b99af54781fbb0d

SHA512
28e85e864551a3a3e4f0d21bdc4a27c60bacf622ee868084931b3a1b70037fc3ebd3dd16bbe5537e153ffe41da7592ca331e59561e31ded8c145daa047666b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\70335_MountUnblock.mp4

Filesize
933KB

MD5
200f90c7a056ca8c8473c607dd1df6dc

SHA1
8ae3da96b3387146ec51cb857318b0501837dcbf

SHA256
7ac963e018f56933788ae703d606d7136d72ca7df6e8aec8de1b77a2f65d09e6

SHA512
1bd114b138828c364e935b1da94dc3742c78071f5713994b48d1a289109d617304df711d8f6b531f7340539374cad4f1b179f9bb851a6540ea493d679c5cb404

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\75189_SwitchSelect.docx

Filesize
230KB

MD5
7a49fb8c55be926f73b780745471cb9c

SHA1
ed62e85b56ce08747a66f415db66f0c5742d896d

SHA256
667e20cf1732992282eb66feaf8a76ce3d7d40ab29f6588bd14abeb3e6573f84

SHA512
3731b1427a1df70762fbe085f65e25e356e894ba38707aa6b00a2aef7468c77e16e8ceff7ba5ca452afc38c5fea3207ead458320de5689069dca0b909f7d5e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\76392_RestartConnect.xlsx

Filesize
345KB

MD5
1d3b7d2c01516333e666cdd0b02a1175

SHA1
9443dc9a698fb1bc848292b4cc8ca7e285c7e46e

SHA256
a58d742a7adc95c379d644ebf55c41d08c6ebb47ffd8ebc80a7f767a77054ebc

SHA512
b9147790e1ee938a024ad96e01995eb8cb1df82514c3373190bd61d761bdd8f0e1badd0ef2d8d3abe0e48772a65a526160c0729c86c6f796fe88cb0333a85fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\7746_CompareResize.doc

Filesize
1.1MB

MD5
7107c2fbcb7e8348cbc44babab227697

SHA1
cc640e91bb3f9f224ea1fec2412880441055254b

SHA256
335c0a696abb62a7f3cc52d119eb33ad046ff00697070e083a2a2e20cd72a4a9

SHA512
8c6999d7416237d485345d6235428fc4ea9eb2aa38d05ab74308e75e8f17548722ab441074463342462247092f688b860203284faecb7d8f09b2e704f744d78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\79827_ResumeWait.ps1

Filesize
496KB

MD5
d068137d636b5fddf5636c384f81f950

SHA1
7255c811f6c075dd790843509ce7288a38ef19e5

SHA256
729292abea1a34e3b49b44479209f5bb36450651419dab41ff5f785a65562b6b

SHA512
537086ecb6bc9e36d94a6a63815d2f193df75f871ef5a16fd31eaad0802b590f453e11a3df2936fce40893f504b24c065c1260389794584459403599d7b2bb8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\84007_GrantCheckpoint.jpg

Filesize
560KB

MD5
86ff194c09a31dc2d0dfda863374247a

SHA1
3f66165b17e93c6547d831d7a6bbc4085d3a2913

SHA256
38e0267c6b088d417981c00738a61ff5bed75059d8a2c7d7840688586781981d

SHA512
31428fb47e88c96f1ebfd185fc278ab107d7676879910bf66749b9a3188caa04b2fb21d3b4de2bb318134622a6ec85546e2f816f99066d9a6f86e9ef223e569f

Download Submit
C:\Users\Admin\AppData\Local\Temp\[GB]KBKWGEBK_181.215.176.83\Common Files\84656_RemoveJoin.mp3

Filesize
272KB

MD5
e96316bbdb26c7b908020b1b62e47d04

SHA1
8b34e0243468e29d06fcedde9b18ec046eb1c301

SHA256
59dba3f7b2ebd8a0354872750d23ae96c679b9b8441a46ee52c89aa64bd6cb2e

SHA512
22e9c9d74a8227128d9cf2f144c895f4cc6c34051ad9d8c393de59fe27ca938eeccda4354cf9064bfa8e410848fdd7177c37e5a5d6682e324019c2f0859ce179

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\Cryptodome\Cipher\_Salsa20.pyd

Filesize
13KB

MD5
2ce3043d6fbd62bcbe6948a1e6a789f0

SHA1
7a5e9bc5a96bd2ec677927fb014073e7cdb70f3b

SHA256
c5a4ac8202a0211163938b6306e3a678cc461ed8e283f4c4601748d2e50783a3

SHA512
8fca5216d65c66640541b31e21a7eb18f510c5c0d3420bff5581337875a6f68dd808f35d61a759a26aad9ae4f50aa1580e8d90e016d9acdc5aa2d04cfaad4377

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\Cryptodome\Cipher\_raw_cbc.pyd

Filesize
12KB

MD5
8d17946e6b1936061203afe20cddb5b0

SHA1
589dac4d2864fdc0219b0de3973b2ee0023cd5ea

SHA256
bb9898057572f17131bb63d513c19901e29d2e29215f7a93d6d84fa537475f0b

SHA512
3354942781e4d36b84d83ab6959707d29f6e25d3614b15a228d63d084f6f2a280bfc9153f24ea0fef489fa7043e21eb67e4b6d3ad7d073fde37f6206462f5931

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\Cryptodome\Cipher\_raw_cfb.pyd

Filesize
12KB

MD5
606e85b094ae6752e1099a176aa20f09

SHA1
35e9355ce75b57111d3793502636d5fcd78d34a4

SHA256
917fa3438b61cc207d73bd72cda6c42cd08656a2187fd9ca2860c67c12677238

SHA512
19de7b6c567e997825f2f08773c45a3562bc3980248de31738395cafa0306707a82f912a8b9b1dba440162443e1554e87ef5586776189b763576d9a7aca9e587

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\Cryptodome\Cipher\_raw_ctr.pyd

Filesize
14KB

MD5
f3cfd044825e9c08ce37a8034e2ed786

SHA1
51637c5678aedf528adef8036c53513495fcbb44

SHA256
bcbe37f565b91a127e40634db8e7e1b8b1ce3e1344f3fa082496b93d75435b80

SHA512
fd9f8ae46a438138c31408ebf9129dd507a8fd6dc24f24eae2b2dd8bd90e8b78afb0aef82a314ca5566d4d1bb7d166642dd2e7d7ea8e484c0261f623b2c1c15b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\Cryptodome\Cipher\_raw_ecb.pyd

Filesize
10KB

MD5
4db0ac98329ae64cec9c28570af52968

SHA1
8f7d327c1049c27b0df6bc6c2017cc302ba99a10

SHA256
5a43e3809403668ed6c6f17a71828eb8cd0dcb64afc09b815a4b9f05c3661714

SHA512
515e0b972a644620c27b3c074aee62b8ba5aa679b0e1c936f616c5537a83c7ca762b7a6c7acc3279ab235d1d344db9423cdc1abf7c72775d4bbfb2cb24cbf6b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\Cryptodome\Cipher\_raw_ofb.pyd

Filesize
11KB

MD5
dae7f4dd6792fb84c91bd45d44ed6c96

SHA1
a88eb81d4d72adc4c7f7402338f9d5760957efc3

SHA256
01eb2117f0223f0447cd16b5ec79baf3430871da8ef461404ba13592d2e8a89c

SHA512
66e98ae82073abb24e9053203f41cebb4ac30a461fe2a62baa1190970e1be7567f495914e017ec94b6b911bab721e63a7ff2d1d85e29d5824ab3d9bc9fb9fce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\Cryptodome\Hash\_BLAKE2s.pyd

Filesize
13KB

MD5
1dee6707a941e02202a47c58408ed538

SHA1
511387a5a611119ba81377931da5a8da5c429b78

SHA256
4e76a0be3e295571172cf1d06dbcc48f715357bb496d8567d9376667326fa5ef

SHA512
f29063d04151c9df75ca2c138fba5f9e4da551f0fdfa7a8a83390df0dcde064038ba87eec4c852a87d80cef0dc38306aed1121d06a6b337e4cc722e4057c432a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\Cryptodome\Hash\_SHA1.pyd

Filesize
17KB

MD5
2efa942a436ca17562fb49bb66acdcc4

SHA1
50b2841914e9a1237ac29c7a681f0951c03d59a4

SHA256
4810a6392848b3ff20d67a531a26daaf2e1f2fe37cf61c0245d24cb0fa00177d

SHA512
bad96c34d318b975330f720b422c758ddc91ae6ab34b873f9a68f060f52552939654ac7a78d49ea787d7f182e293c604f772bea9e027d0159a43c9f06957d392

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\Cryptodome\Hash\_SHA256.pyd

Filesize
21KB

MD5
15e2c2434668d1648d9147156b0a44c6

SHA1
bea635adfd889381cc324d2612606e409518261d

SHA256
ebee833d40ed09abccff1f415b4a4cb1ec6f8d84431067980b09a36450edb9f8

SHA512
197818202b07f97dc370f456a1f59a5210c8af7e8221d6e0bbf8a96e8190668dd29d353bffb0f833fc622b8f797558708446cdde7a062ecd8c66d67b87262445

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\Cryptodome\Protocol\_scrypt.pyd

Filesize
12KB

MD5
308c6e862a3554f1b5587d003f4b1bbf

SHA1
800955d3a24065766e5825c8324b7f48cd02f073

SHA256
671aad8b7fae31e076df50c947cd198369eea6379e6fa1b058596e528f5da561

SHA512
35b27a6320a8046f7e7bc42b9af8414b076f5334467576a0e83c6d7992ec3675f73cf0fc72ae6da402ff70dd16fcc0c29287ab27ad04bb346d5229d62deb54a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\Cryptodome\Util\_strxor.pyd

Filesize
10KB

MD5
174b652c8e6c40c36c8ab06a20a34c01

SHA1
f3cb9321100dce3a8d79b0fc517cc58e05d26e41

SHA256
42af8d99fc975720585d25d767fc825d4922c088b6c2b13ee2de23e439523610

SHA512
9f0c444069e477a043c85f606bf1a3fb695773dbc16d1124a4b2d771ea0385b797552031433cb625d7dc9c8d490eb0ef8fa2c13aa628ebba58df6a0530913f32

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\VCRUNTIME140_1.dll

Filesize
48KB

MD5
f8dfa78045620cf8a732e67d1b1eb53d

SHA1
ff9a604d8c99405bfdbbf4295825d3fcbc792704

SHA256
a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

SHA512
ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\_bz2.pyd

Filesize
83KB

MD5
dd26ed92888de9c57660a7ad631bb916

SHA1
77d479d44d9e04f0a1355569332233459b69a154

SHA256
324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697

SHA512
d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\_ctypes.pyd

Filesize
122KB

MD5
c8afa1ebb28828e1115c110313d2a810

SHA1
1d0d28799a5dbe313b6f4ddfdb7986d2902fa97a

SHA256
8978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0

SHA512
4d9f41bd23b62600d1eb097d1578ba656b5e13fd2f31ef74202aa511111969bb8cfc2a8e903de73bd6e63fadaa59b078714885b8c5b8ecc5c4128ff9d06c1e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\_decimal.pyd

Filesize
251KB

MD5
cea3b419c7ca87140a157629c6dbd299

SHA1
7dbff775235b1937b150ae70302b3208833dc9be

SHA256
95b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5

SHA512
6e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\_hashlib.pyd

Filesize
64KB

MD5
d19cb5ca144ae1fd29b6395b0225cf40

SHA1
5b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4

SHA256
f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa

SHA512
9ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\_lzma.pyd

Filesize
156KB

MD5
8cfbafe65d6e38dde8e2e8006b66bb3e

SHA1
cb63addd102e47c777d55753c00c29c547e2243c

SHA256
6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff

SHA512
fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\_queue.pyd

Filesize
31KB

MD5
7d91dd8e5f1dbc3058ea399f5f31c1e6

SHA1
b983653b9f2df66e721ece95f086c2f933d303fc

SHA256
76bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d

SHA512
b8e7369da79255a4bb2ed91ba0c313b4578ee45c94e6bc74582fc14f8b2984ed8fcda0434a5bd3b72ea704e6e8fd8cbf1901f325e774475e4f28961483d6c7cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\_socket.pyd

Filesize
81KB

MD5
e43aed7d6a8bcd9ddfc59c2d1a2c4b02

SHA1
36f367f68fb9868412246725b604b27b5019d747

SHA256
2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a

SHA512
d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\_ssl.pyd

Filesize
174KB

MD5
6a2b0f8f50b47d05f96deff7883c1270

SHA1
2b1aeb6fe9a12e0d527b042512fc8890eedb10d8

SHA256
68dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a

SHA512
a080190d4e7e1abb186776ae6e83dab4b21a77093a88fca59ce1f63c683f549a28d094818a0ee44186ddea2095111f1879008c0d631fc4a8d69dd596ef76ca37

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\_wmi.pyd

Filesize
36KB

MD5
bed7b0ced98fa065a9b8fe62e328713f

SHA1
e329ebca2df8889b78ce666e3fb909b4690d2daa

SHA256
5818679010bb536a3d463eeee8ce203e880a8cd1c06bf1cb6c416ab0dc024d94

SHA512
c95f7bb6ca9afba50bf0727e971dff7326ce0e23a4bfa44d62f2ed67ed5fede1b018519dbfa0ed3091d485ed0ace68b52dd0bb2921c9c1e3bc1fa875cd3d2366

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\base_library.zip

Filesize
1.3MB

MD5
aba776964e87291a556a2d5389476d1e

SHA1
41c45c987bb01d44901a9c6c41817196fe2aa799

SHA256
a9790e38c2e50f57e9b892ae16ebf726af09b185342b76ba57eb600b2d8994d6

SHA512
4dd38b435437472f3b8ef52aa145894aae33c9541e6eeace846debc64863d9831841b39c5ff9b9683e66979e229b29751a8509ba423eca79db06cff54dbf9363

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\certifi\cacert.pem

Filesize
292KB

MD5
50ea156b773e8803f6c1fe712f746cba

SHA1
2c68212e96605210eddf740291862bdf59398aef

SHA256
94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47

SHA512
01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\charset_normalizer\md.cp312-win_amd64.pyd

Filesize
10KB

MD5
d9e0217a89d9b9d1d778f7e197e0c191

SHA1
ec692661fcc0b89e0c3bde1773a6168d285b4f0d

SHA256
ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0

SHA512
3b788ac88c1f2d682c1721c61d223a529697c7e43280686b914467b3b39e7d6debaff4c0e2f42e9dddb28b522f37cb5a3011e91c66d911609c63509f9228133d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Filesize
120KB

MD5
bf9a9da1cf3c98346002648c3eae6dcf

SHA1
db16c09fdc1722631a7a9c465bfe173d94eb5d8b

SHA256
4107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637

SHA512
7371407d12e632fc8fb031393838d36e6a1fe1e978ced36ff750d84e183cde6dd20f75074f4597742c9f8d6f87af12794c589d596a81b920c6c62ee2ba2e5654

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\libssl-3.dll

Filesize
768KB

MD5
19a2aba25456181d5fb572d88ac0e73e

SHA1
656ca8cdfc9c3a6379536e2027e93408851483db

SHA256
2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

SHA512
df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\python312.dll

Filesize
6.6MB

MD5
cae8fa4e7cb32da83acf655c2c39d9e1

SHA1
7a0055588a2d232be8c56791642cb0f5abbc71f8

SHA256
8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

SHA512
db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\select.pyd

Filesize
30KB

MD5
79ce1ae3a23dff6ed5fc66e6416600cd

SHA1
6204374d99144b0a26fd1d61940ff4f0d17c2212

SHA256
678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0

SHA512
a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45002\unicodedata.pyd

Filesize
1.1MB

MD5
b848e259fabaf32b4b3c980a0a12488d

SHA1
da2e864e18521c86c7d8968db74bb2b28e4c23e2

SHA256
c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c

SHA512
4c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\bsrtt.exe

Filesize
9.3MB

MD5
7be18f7881115b4b9fa5b19bc5da7e23

SHA1
838839f163f8cb146ef9078956fe9a733d096299

SHA256
e28e65b42f2596dc34c9845728e4ee6884d3e42b20397a9c4fcbe8cd63f8c193

SHA512
50e8ee8c98f151cce3e7ea6a1eb5952a97d49bac553cd684e9f4d2bc631d41a07186b3ea412f8704873b00098513408f08d3c3229a52ec36b5592238650dbff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tkstt.exe

Filesize
9.6MB

MD5
5dc53cbb8e11b7b2b4ea4711df467792

SHA1
a5adeb2f1d7086de7c5f0def8a579d276b7a0268

SHA256
403f67db8d434c6c9d12716139fb281317ca78dd29b5385331b977cd07d9cf4d

SHA512
b4c3a451011dfd593bd0317cb7a60191d17235bdf311b5f479c697a452a4463d2734007b810dca10e7c4d2fe2486d0ed814b955f01d5b7c6c6b4be4389dcc93c

Download Submit
memory/3196-85-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/3196-6-0x0000000006040000-0x00000000060B6000-memory.dmp

Filesize
472KB

Download
memory/3196-16-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/3196-15-0x00000000746FE000-0x00000000746FF000-memory.dmp

Filesize
4KB

Download
memory/3196-14-0x0000000007090000-0x00000000070AE000-memory.dmp

Filesize
120KB

Download
memory/3196-13-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/3196-11-0x00000000070C0000-0x0000000007664000-memory.dmp

Filesize
5.6MB

Download
memory/3196-8-0x0000000006A60000-0x0000000006A82000-memory.dmp

Filesize
136KB

Download
memory/3196-7-0x00000000060C0000-0x0000000006126000-memory.dmp

Filesize
408KB

Download
memory/3196-0-0x00000000746FE000-0x00000000746FF000-memory.dmp

Filesize
4KB

Download
memory/3196-5-0x0000000005F20000-0x0000000005F9A000-memory.dmp

Filesize
488KB

Download
memory/3196-4-0x0000000005DD0000-0x0000000005E62000-memory.dmp

Filesize
584KB

Download
memory/3196-2-0x0000000005A40000-0x0000000005AF2000-memory.dmp

Filesize
712KB

Download
memory/3196-3-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/3196-1-0x0000000000F90000-0x0000000001060000-memory.dmp

Filesize
832KB

Download
memory/3196-530-0x000000000A0E0000-0x000000000A434000-memory.dmp

Filesize
3.3MB

Download
memory/3196-567-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads