Analysis
- max time kernel
157s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
14/02/2024, 07:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b21cde6bf0bdbd2c43950a138f90b1c.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
9b21cde6bf0bdbd2c43950a138f90b1c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 9b21cde6bf0bdbd2c43950a138f90b1c.exe
- Size 437KB
- Sample240214-jfftpaea32
- SHA256 7a3caaf060953f658a47fe9e6e5c41c4c77dee2aa1d777f2d3d07676bf7712a5
- MD5 9b21cde6bf0bdbd2c43950a138f90b1c
- SHA1 18f3ceb3e36a5edd87a1d5dec9c40d084aa827db
- SHA512 624a1891b4e2837dad9d60123d4758d877d7d1d63d3500a8b67acd84b33a1454f44ecf7704a2db7c7b321c4f33c3d5becddf757ff121ab594cd9aca8171b6cfd
- SSDEEP 12288:R9OfyIwj+9DKYRSXsGekv8P31AyhC7gS5fNuQEOa:mfej+9DnocGekv8dA2C795fNy9
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 9b21cde6bf0bdbd2c43950a138f90b1c.exe Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation rinst.exe - Executes dropped EXE 2 IoCs
pid Process 4364 rinst.exe 3720 testbkp.exe - Loads dropped DLL 4 IoCs
pid Process 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 4600 9b21cde6bf0bdbd2c43950a138f90b1c.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\testbkp = "C:\\sysfiles\\testbkp.exe" testbkp.exe - Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A} testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "PK IE Plugin" testbkp.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE - Modifies registry class 47 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1 testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\ = "BPK IE Plugin Type Library" testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource" testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\ = "IE Class" testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer\ = "PK.IE.1" testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ThreadingModel = "Apartment" testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\ = "IE Plugin Class" testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "IE Plugin Class" testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID\ = "PK.IE.1" testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32 testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0 testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR\ = "C:\\sysfiles\\" testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}" testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32 testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A} testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS\ = "0" testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32 testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32\ = "C:\\sysfiles\\testbkpwb.dll" testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A} testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource" testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0" testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A} testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}" testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A} testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\Programmable testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0 testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32 testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0" testbkp.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings rinst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID testbkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID\ = "PK.IE" testbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ = "C:\\sysfiles\\testbkpwb.dll" testbkp.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4952 WINWORD.EXE 4952 WINWORD.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3720 testbkp.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 3720 testbkp.exe 4952 WINWORD.EXE 4952 WINWORD.EXE 4952 WINWORD.EXE 4952 WINWORD.EXE 4952 WINWORD.EXE 4952 WINWORD.EXE 4952 WINWORD.EXE 3720 testbkp.exe 3720 testbkp.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4600 wrote to memory of 4364 4600 9b21cde6bf0bdbd2c43950a138f90b1c.exe 83 PID 4600 wrote to memory of 4364 4600 9b21cde6bf0bdbd2c43950a138f90b1c.exe 83 PID 4600 wrote to memory of 4364 4600 9b21cde6bf0bdbd2c43950a138f90b1c.exe 83 PID 4364 wrote to memory of 4952 4364 rinst.exe 85 PID 4364 wrote to memory of 4952 4364 rinst.exe 85 PID 4364 wrote to memory of 3720 4364 rinst.exe 86 PID 4364 wrote to memory of 3720 4364 rinst.exe 86 PID 4364 wrote to memory of 3720 4364 rinst.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b21cde6bf0bdbd2c43950a138f90b1c.exe"C:\Users\Admin\AppData\Local\Temp\9b21cde6bf0bdbd2c43950a138f90b1c.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RarSFX0\birthday_card12.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4952
-
-
C:\sysfiles\testbkp.exeC:\sysfiles\testbkp.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3720
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\birthday_card12.doc
- Size 228KB
- SHA256 b5239f4089adea1a52f3978c416b32a05940966f124f31fcf76ae6d2c0c1db5c
- MD5 76feee63e1cf214326c1e7ba31c931f3
- SHA1 3bc3f29005cb6c2721ee0cd335fd21f6b85e36f8
- SHA512 473aedaa42e43ecb15ae1e803c1eddfbb76c620fb7557d94fd6a602f5e6eae3f3eea447b2fc089a18fe5dc8bb4feee66a17a139b98e9aaee8067973155a0fb01
- SSDEEP 6144:LgoxYhMo58rEbQCVaWGTtvvQXYbm/7vtNtW:qhj59aWGJvvQIm7lNtW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat
- Size 996B
- SHA256 98d098087497d7e3558051d1609985cb10adc942923e823e26d618d927a9fbea
- MD5 5046125cc32c5b299d69d5d4aa20fd0b
- SHA1 5e1726d0ad89beffeb29805554565c76e1084bf0
- SHA512 c1bc0c10c0f474b4f48de478e654280bba702bc8de5053efe46603a8e0c4caf2fa1ecf2911913039369d39b1479a152764521b0fd5b0544e1c5259abb0d71648
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\pk.bin
- Size 3KB
- SHA256 5893ca5c22de4ac35614c836e93759013ab294cedd266046a4db9dfdffd8c623
- MD5 519121e6f3cf6370aca2b6db28e2a50c
- SHA1 e7e39ba0634d37703b411e98ddc0c62b0eb0c940
- SHA512 ecdf808f1e5ccfbad5cbc7b44c14586303efe8bae9ac1eb18d95443a3e1f34daf9dcd2a4fab122b3aaf59733f8b3622fc34f0930c48c3028d7b91800e8c631cf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
- Size 7KB
- SHA256 446658dd5af649857fff445c600f26cdc1d0c19c86a080f312b89b1890182092
- MD5 fbe4bab53f74d3049ef4b306d4cd8742
- SHA1 6504b63908997a71a65997fa31eda4ae4de013e7
- SHA512 d458ab806a3ed3d1494a13ad8a75df874a0b227cb4f337996cb82df3c4a26dc9c4fe48a664b53b052a4af123ea8d89911d9d9493870e6b5992d5621a32260c2f
- SSDEEP 192:nB22Blo4VgSAP1oyn5g1to5R8FPSmdvkEhew:B/lo6gS21Dg1tYR8FP1CE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\testbkp.exe
- Size 400KB
- SHA256 db46177f12a75c61a34228786cce40274feac9b91af3b8108862866cbcb7aec8
- MD5 375c1c0f069b777b4e1ef24b9a9d279e
- SHA1 722b7707d659aa5f292cde8ab4b846d9ecc5cb4a
- SHA512 062df1ed065293ba25103629ddd9b9a65d5d64c560bdb39f1d795cee24a66fd8ad45ce94fac5ba157c9b4ac7a90fd4f23299790ff33f411a2cc80a1d72c4ceec
- SSDEEP 6144:H/idavN/wMY+kneXi9x+VLJDhyIC2fPqGmLHilDOz:f0avN/wMYpIZhyIr9llDI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\testbkphk.dll
- Size 24KB
- SHA256 f29e5bbce4a5d4bc22281f98834fb6b98b59265ad177fea5ac11a17db9a0341c
- MD5 abf18e31ced66934a9b1cbd2276082f6
- SHA1 40d7660c22a143e8906c03081c8af24cca99963a
- SHA512 7de58f1f19b423d74131f08140e87d9b1b9199f799e8b4e31865fa4684d0a4ab5e0f11a8c173ee650f2fc5820d4d8b93022ffd49f30dfd5af28559660480658a
- SSDEEP 96:Hx40cKY9Mugr3TtfOS/TfiZCV3iU1P0R19Im74w2T7AYPjAsR1Hh:Hqn6rrj3/7ajR19N74/TkYPj7PHh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\testbkpwb.dll
- Size 40KB
- SHA256 e8ca2d684edc6a9010a8fab08975d73c4d63890ee27bb266d2175d16f619bd4d
- MD5 374e61d6a78f9593d42845e9ea3a7d95
- SHA1 5930063b7391b3160ce4648d40c88c1eb2dec16d
- SHA512 1403797bb41ff45916e3d33feacba98650b94623c5b90db35277ef3b066c4d80a982f7f883de09317d2f7d24322455d2e05080cf28e4e055da67203565814eda
- SSDEEP 768:HIU61Ap8MRUXGRL3Kq73ToWguaPUzCXf6Xi:Hg1AS6UXGRL3Kqjs4aPJXf6Xi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\sysfiles\pk.bin
- Size 3KB
- SHA256 f1757d4cd8483f505dfa96d2419a0cfc6627eb6934d9360eb15e5b34e5986925
- MD5 2fd01a49456a124e100195a4e632d5fb
- SHA1 607e726c7be50d7e03d8e372861f7a13ccf3e5ef
- SHA512 9b00cd3ab80bd508b29cb2aa4ad7328d277d9343f0f7dba84c5dfc96352755f82e2196fa115c9d4d7556eacbb19906b5a7418af2991bcf7951f5f132b61dc2c1
- MD5 SHA1 SHA512
- Path C:\sysfiles\testbkp.exe
- Size 139KB
- SHA256 fccb0b408fc1279015b151080df91afcfc4812c31fd2beea640af88fdb1aa9f3
- MD5 ae9d500ba9d9384b0e82338572fb4c40
- SHA1 3b848a0572c78496ad349558bed9bea64aef4d10
- SHA512 3fc6fd1b9b8fe221d93bfaf8742d9fede31aca3fc9aab8f11289e7ecc29d5b6e1b31742fb61b36a0dd4e30dd42eead2fbaa1d946ebbac7b6f13c79033510c045
- SSDEEP 3072:mVdWRP9LG7+cKNfX6aRnxNkePCnMIe7+yUng+KwCx/0YT5plc:cdY9LG7VqfKaRnxNkpnMIe7+yIg+KxFi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\sysfiles\testbkp.exe
- Size 400KB
- SHA256 cbc8cf389f07bdcc20f04a4b9134bae894081ffac27555afb0dd1f6d7aa57450
- MD5 341c7d495813a8e38bc5f4b1e4070341
- SHA1 65c7e0623df72470850f3a8dc9acddae9d680406
- SHA512 b8bab11cd602d8b45f42b3775b86df5faa4f0596ed3ca4e20b77be0040ca32eea5f14f95ef704230238ec56d6a818b66f400b9e9066bb5e854b01bf181571f7c
- SSDEEP 12288:aY9LG7VqfKaRnxNkpbe7zIg+Kxn9BRvnoSmBnvQrRtUtvH:aY9LG7VqfKaRnxNkpbe/Ig+Uz1oSm9cW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\sysfiles\testbkphk.dll
- Size 24KB
- SHA256 cfb1a5165cfb64dc8e33f2e265ffc41a62b18539582ac1d3c2dcc55f5b40719c
- MD5 d3d919fd95dbcffd0d9658dc24f80ba6
- SHA1 9cdde1f9fce4c575c1a3f8ef7845ad7dbeec6205
- SHA512 9c04aeddac457c818d4ab92f7e8cf2e17ba3fc251b534edf2a31d49a5411bd1fda910345775b57b5afc3c4ff5bf9cba5003e68ffd69fd058b26e1b17f885a852
- SSDEEP 96:v5+7aXWVeCs602aK/2z5gPInuoxLOJhp4TzEvkulzOqKdtr5jposUGEkq+O/:v50aXWVl0HtKI/QZ4cvku9nilo8Ek
- MD5 SHA1 SHA512 SSDEEP
- Path C:\sysfiles\testbkpwb.dll
- Size 40KB
- SHA256 3285df0c25d4b9b6d5ccbe166a3ce3d04f5cb3a0d61c8bf29bf5f953e51b0977
- MD5 21d4e01f38b5efd64ad6816fa0b44677
- SHA1 5242d2c5b450c773b9fa3ad014a8aba9b7bb206a
- SHA512 77dae941676a56664da89c7670d29ed5402032c8040df1cc231986733c78f0dc56c41f7a276ec9ea8336e3fa2bfc68d3121048e9585bf0d8a98917d799f669b8
- SSDEEP 384:LQ/SYK6Caix+gx8mMuaLiDBEov2dd7IEMDxk/tVwqG6HlH9AOvyyryQmwHEmY:LQ/SYDRipDMutE9Wh6FVwq/lHaqrVPk
- MD5 SHA1 SHA512 SSDEEP