Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system - submitted
24/02/2024, 09:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-24_7c483e8578c21636934b16dc0a9ffd9e_magniber_revil.exe
Resource
win7-20240215-en
windows7-x64
12 signatures
150 seconds
General
- Target 2024-02-24_7c483e8578c21636934b16dc0a9ffd9e_magniber_revil.exe
- Size 4.6MB
- Sample240224-ln16psgh4v
- SHA256 b36949331cf816d3870943c1d6732913b010a3dd373cb90a996566d8e98747ab
- MD5 7c483e8578c21636934b16dc0a9ffd9e
- SHA1 c4d365fc34beed9657b48b40dcdcfff49f776b9e
- SHA512 f2abc3d1e132fd3f79504fb336c0bbb9cf672f5fc234242047e1f2f9da5b0c68ec61adcae498a9a2cbe6ff7f2ba16e7449dc09b5bb55c305a4e9272e416c155a
- SSDEEP 98304:H6lk+sheCv4carXaVldUmGV9DI9A2cA2IWAufNyNxN:alk+sheep9LlDYNyNxN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
phorphiex
C2
-
http://185.215.113.66/
Wallets
-
0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b
-
THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto
-
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
-
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
-
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
-
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
-
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
-
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
-
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
-
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
-
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
-
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
-
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
-
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
-
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE
Signatures
- Phorphiex payload 1 IoCs
resource yara_rule behavioral2/files/0x0006000000023224-32.dat family_phorphiex -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2110611439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2110611439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2110611439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1689313806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1689313806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1689313806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2110611439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1689313806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 2110611439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 1689313806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1689313806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2110611439.exe - Downloads MZ/PE file
- Executes dropped EXE 8 IoCs
pid Process 2368 59B9.exe 2132 1689313806.exe 1956 2831719510.exe 2020 2110611439.exe 2392 170326745.exe 2800 528317244.exe 436 2614327798.exe 1056 260622267.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1689313806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1689313806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1689313806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2110611439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 2110611439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2110611439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2110611439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1689313806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2831719510.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2110611439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 2110611439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2110611439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1689313806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 1689313806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 1689313806.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winknavrso.exe" 2110611439.exe Set value (str) \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\winknavrso.exe" 2110611439.exe Set value (str) \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\winxsdrvcsa.exe" 1689313806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winxsdrvcsa.exe" 1689313806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winpsdrvnas.exe" 2831719510.exe Set value (str) \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\winpsdrvnas.exe" 2831719510.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\winpsdrvnas.exe 2831719510.exe File created C:\Windows\winknavrso.exe 2110611439.exe File opened for modification C:\Windows\winknavrso.exe 2110611439.exe File created C:\Windows\winxsdrvcsa.exe 1689313806.exe File opened for modification C:\Windows\winxsdrvcsa.exe 1689313806.exe File created C:\Windows\winpsdrvnas.exe 2831719510.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2540 436 WerFault.exe 102 - Suspicious behavior: SetClipboardViewer 2 IoCs
pid Process 1956 2831719510.exe 2020 2110611439.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4764 wrote to memory of 2368 4764 2024-02-24_7c483e8578c21636934b16dc0a9ffd9e_magniber_revil.exe 91 PID 4764 wrote to memory of 2368 4764 2024-02-24_7c483e8578c21636934b16dc0a9ffd9e_magniber_revil.exe 91 PID 4764 wrote to memory of 2368 4764 2024-02-24_7c483e8578c21636934b16dc0a9ffd9e_magniber_revil.exe 91 PID 2368 wrote to memory of 2132 2368 59B9.exe 94 PID 2368 wrote to memory of 2132 2368 59B9.exe 94 PID 2368 wrote to memory of 2132 2368 59B9.exe 94 PID 2132 wrote to memory of 1956 2132 1689313806.exe 95 PID 2132 wrote to memory of 1956 2132 1689313806.exe 95 PID 2132 wrote to memory of 1956 2132 1689313806.exe 95 PID 2132 wrote to memory of 2020 2132 1689313806.exe 96 PID 2132 wrote to memory of 2020 2132 1689313806.exe 96 PID 2132 wrote to memory of 2020 2132 1689313806.exe 96 PID 1956 wrote to memory of 2392 1956 2831719510.exe 99 PID 1956 wrote to memory of 2392 1956 2831719510.exe 99 PID 1956 wrote to memory of 2392 1956 2831719510.exe 99 PID 1956 wrote to memory of 2800 1956 2831719510.exe 100 PID 1956 wrote to memory of 2800 1956 2831719510.exe 100 PID 1956 wrote to memory of 2800 1956 2831719510.exe 100 PID 2132 wrote to memory of 436 2132 1689313806.exe 102 PID 2132 wrote to memory of 436 2132 1689313806.exe 102 PID 2132 wrote to memory of 436 2132 1689313806.exe 102 PID 1956 wrote to memory of 1056 1956 2831719510.exe 105 PID 1956 wrote to memory of 1056 1956 2831719510.exe 105 PID 1956 wrote to memory of 1056 1956 2831719510.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_7c483e8578c21636934b16dc0a9ffd9e_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_7c483e8578c21636934b16dc0a9ffd9e_magniber_revil.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\59B9.exe"C:\Users\Admin\AppData\Local\Temp\59B9.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\1689313806.exeC:\Users\Admin\AppData\Local\Temp\1689313806.exe3⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\2831719510.exeC:\Users\Admin\AppData\Local\Temp\2831719510.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\170326745.exeC:\Users\Admin\AppData\Local\Temp\170326745.exe5⤵
- Executes dropped EXE
PID:2392
-
-
C:\Users\Admin\AppData\Local\Temp\528317244.exeC:\Users\Admin\AppData\Local\Temp\528317244.exe5⤵
- Executes dropped EXE
PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\260622267.exeC:\Users\Admin\AppData\Local\Temp\260622267.exe5⤵
- Executes dropped EXE
PID:1056
-
-
-
C:\Users\Admin\AppData\Local\Temp\2110611439.exeC:\Users\Admin\AppData\Local\Temp\2110611439.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\2614327798.exeC:\Users\Admin\AppData\Local\Temp\2614327798.exe4⤵
- Executes dropped EXE
PID:436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 2205⤵
- Program crash
PID:2540
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 436 -ip 4361⤵PID:3876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\06IBT2KQ\2[1]
- Size 23KB
- SHA256 4ecc3858eb5f437af29b9a7ed8fce1b2b6650573f06df09e551e77b1e599195b
- MD5 07d8d1886e9515653645a06317888a14
- SHA1 50efdfb1b292bb28b9177e19e898d8b4ec59ec09
- SHA512 09d51a4ddb2d7e772547f5af7987cbd79c907b5cdcb13e6e3562d81a1a097c3a38f9f1b7c6b98ca81687990dcefdccb2b025ce2b253981dd94ecb554184e6894
- SSDEEP 384:bwHpS3LDv1xjNaM69O/i01RnL+WoLrLdSIR7KDNxfQpkrlpzdZ5zj4y0AgH3CxwU:8Hp0Lb1xj1iQi01RL+WoLrLIIRUrjlpZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\06IBT2KQ\5[1]
- Size 18KB
- SHA256 0367572142c5d7aa36047009d9f45e0d30436ecbcfe8910167cf8f39c678d3d9
- MD5 b30bdd3e25437d7ab8ab8435d3e7805c
- SHA1 b0b890566c00d1975e266dfceb2c93671631f77e
- SHA512 976a28d50b442589a9aeb9c9eac37081520c62c95e4c097442a2c9b6f33c03c596b713c9f3b85a09c7eb7033448d90bd03357d43f64d6465e474ee111f685806
- SSDEEP 384:KAtWjHHaL8zTe4n+xXp4C4OL3ecj+aS2X4YAX1pxN9kVRqFHH:rtWjHxxAXp4CDL3e6VX4YAPxEeHH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JQRQN291\1[1]
- Size 86KB
- SHA256 86b717189b01aa5db7f367a6bb926f55379db91c757d50f3eab278750f405c1f
- MD5 fb7320dd95b6d47b722520ac0ffe1fda
- SHA1 4e4411fb5188b32b9310cd021fb262fbabe271a3
- SHA512 0487772a84d60c4aa739d7addc43687f189bf144a0ec4ffcbf4822b60711d253df89802fb546b04fd5acf84e55acde6e0b08deb83281a835ab0d5e2905710376
- SSDEEP 1536:gf8NjGLI9Q+PM5pQZKIvhcYFKNij+cA7rRJO9wQ/MVlB78C9NrNOScviewBY1:FVmpa7cNiicAfvK40KNpOScD1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JQRQN291\3[1]
- Size 86KB
- SHA256 2906e7f0b36cced4343b5aaa17fc04e85ca0d4258b90bf3c2b31f4914a1b068e
- MD5 504be39e4bf87420a31b86c2d9b97952
- SHA1 7ae264d82db82ef6c190e03966f92bc6c7e19b80
- SHA512 87aea980bcd5c9453e630cf6822bb9e0781226304a2ad7fa6827ea2a64f46c22ff99252cb5af772cf6fefc37e09c0f29ea3b99c074eca80081bd6e04f633046d
- SSDEEP 1536:7X8NjGLI9Q+PM5pQZKIvhcYFKNij+cA7rRJO9wQ/MVlB78C9NrNOScviewBY1:7sVmpa7cNiicAfvK40KNpOScD1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1689313806.exe
- Size 79KB
- SHA256 94a66eea65edd08ca19bf6db266058e81714312b6a51892298b461ffd8b90161
- MD5 bb3d7bd66c92454429a8c78bf64f977b
- SHA1 85563e7850d20f984a6264f68602fcc8a2b1a73f
- SHA512 cacd552b6cb5a1b1ee3569428681d154c25f6fa4b7141e33a64153b30711c345b6335161aa4a87688c047610cca141091b57cf8fe883769495a3b6caf3f03ea0
- SSDEEP 1536:AQaPX8E9Fmavs2ThOBYHpCVfF7kIchZU8mcwpjNV6IqTlEpF:AQ48BOLhO/DMZJxwpjmTlEpF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2110611439.exe
- Size 23KB
- SHA256 84daa9d52f759af343741880a3b66a3abb886310de7f552743d99e69741c6450
- MD5 9d2b22562b9a3958dfd7e6e6fa7bd66f
- SHA1 1941c24958ac09cf518f4124225b2d0b5d874cf0
- SHA512 8c0b54e01f62207edaaf8f967fe83eacd3e278660c1764feb3fde68bfd376ba875012849f969d8b5922bd6b791a231bf75dc76eade227e2fd25f4791163d9dd1
- SSDEEP 384:psxGwxN5Af+2v877Oo0MOQ+XceXUoRgWScdQhue4/5zF:pSGxCeo4MeXUoiR4e4/5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2614327798.exe
- Size 18KB
- SHA256 fd4c89d7b2d30000e6893e880c948d7f11fa2f8c5053997f746722ec9fff0eec
- MD5 01510572ccaca200b474d553ece2daf6
- SHA1 09a1c497080b50216810dadd7de1dac26b4c209f
- SHA512 8a52959e93b71388ef7bd3d97df461a22bb54de721b2960b52c48c6001bf93cd5bbb7c95ff7d5c0c6fd31e80acdcf35a99cf336bcc3e1ca455a150f8d5c3c35c
- SSDEEP 384:Q6fwvrcjWITuweeeeeeeeWeeeee9MMpPweeeeeeeeWeeeee9MMpPweeeeeeeeWe0:QSwvYDeeeeeeeeWeeeeeCeeeeeeeeWex
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2831719510.exe
- Size 86KB
- SHA256 a8454ee4d51de8582746091a406dd659324d2f7330552431c130f72baedc1266
- MD5 d6dd136183e107163263416aac6786c6
- SHA1 a6b2ec93462b8ecb0bad5688122de2b33a7c0e1c
- SHA512 c42952b6bd8614d07cf755139699eae1df81d5ded4a7b86728c0962d73c225b6b8c12674f649bfc2cb118665c028f4f4888f43d39027380ea2146275ec724a9a
- SSDEEP 1536:yQaPX8E9Fmavs2ThOWw9kYXVUeGbowliN06I68lUpF3bG:yQ48BOLhOlNFzQowlij8lUpFrG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\59B9.exe
- Size 9KB
- SHA256 e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab
- MD5 62b97cf4c0abafeda36e3fc101a5a022
- SHA1 328fae9acff3f17df6e9dc8d6ef1cec679d4eb2b
- SHA512 32bd7062aabd25205471cec8d292b820fc2fd2479da6fb723332887fc47036570bb2d25829acb7c883ccaaab272828c8effbc78f02a3deeabb47656f4b64eb24
- SSDEEP 96:zM2BLwN8GXhc1I+a8gnYFdj9DSYp+BYA8v7cVO15uJxGE9YUBz2qh3C7tCE4ecp:AIwNfC1TUYv9p+OF8JxTmUBzthcqp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\tbnds.dat
- Size 4KB
- SHA256 a740c8a5330d63987570b01f218e819ea79c7375f457cda973d6e575a1744808
- MD5 9e459c13de8ff1a2d93393c73f997081
- SHA1 c0c3406ccbc8e45d014f42681f4b43878bb35d3e
- SHA512 2dd9b43b33ebe244e801141483786fad3ae3e716888afbd4351c6675716b880d1b243edfee130f6add8063c04d18c80e8d28e84af4b76509ca7566e37f75cace
- MD5 SHA1 SHA512