Resubmissions
20-09-2020 09:53
200920-9rh6v6y6ga 1020-09-2020 09:09
200920-94a3wvdaln 1020-09-2020 07:26
200920-gyqrj2hcqj 1020-09-2020 07:11
200920-xak2q5j4ha 10Analysis
-
max time kernel
301s -
max time network
303s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
20-09-2020 09:09
Static task
static1
Behavioral task
behavioral1
Sample
ioxyfx.dat.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
ioxyfx.dat.exe
Resource
win10
General
-
Target
ioxyfx.dat.exe
-
Size
7.1MB
-
MD5
d5f9fa1a8dca5319432f51a5891f7794
-
SHA1
2a937328f5b99eccb9b8c13ed71d6ffb9dff4521
-
SHA256
18f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055
-
SHA512
87013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0
Malware Config
Signatures
-
Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
Processes:
mpcmdrun.exepid process 220 mpcmdrun.exe -
Zhen Executable 6 IoCs
Processes:
resource yara_rule \ProgramData\ioxyfx.dat.exe family_zhen \ProgramData\ioxyfx.dat.exe family_zhen C:\ProgramData\ioxyfx.dat.exe family_zhen C:\ProgramData\ioxyfx.dat.exe family_zhen \ProgramData\ioxyfx.dat.exe family_zhen \ProgramData\ioxyfx.dat.exe family_zhen -
Zhen Ransomware
First seen in September 2020. Drops ransomnote as .ini file.
-
Executes dropped EXE 2 IoCs
Processes:
ioxyfx.dat.exex64.exepid process 1616 ioxyfx.dat.exe 208 x64.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
ioxyfx.dat.exedescription ioc process File created C:\Users\Admin\Pictures\GetUpdate.png.zhen ioxyfx.dat.exe File created C:\Users\Admin\Pictures\HideEdit.png.zhen ioxyfx.dat.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
icacls.exetakeown.exepid process 1928 icacls.exe 548 takeown.exe -
Loads dropped DLL 13 IoCs
Processes:
ioxyfx.dat.exeioxyfx.dat.exeWerFault.exepid process 1240 ioxyfx.dat.exe 1240 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 2016 WerFault.exe 2016 WerFault.exe 2016 WerFault.exe 2016 WerFault.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 548 takeown.exe 1928 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ioxyfx.dat.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\TSUGJN = "\"C:\\ProgramData\\ioxyfx.dat.exe\" -ui" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TSUGJN = "\"C:\\ProgramData\\ioxyfx.dat.exe\" -ui" ioxyfx.dat.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
ioxyfx.dat.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1.bmp" ioxyfx.dat.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ioxyfx.dat.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN092.XML ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME17.CSS.zhen ioxyfx.dat.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\ResourceInternal.zip.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageScript.js ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341551.JPG ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Office14\ONENOTEIRM.XML.zhen ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg.zhen ioxyfx.dat.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.zhen ioxyfx.dat.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.zhen ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginDialogBackground.jpg.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis.css ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL104.XML ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN081.XML.zhen ioxyfx.dat.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png.zhen ioxyfx.dat.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\form_edit.js ioxyfx.dat.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Grayscale.xml ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGZIPC.XML.zhen ioxyfx.dat.exe File created C:\Program Files\7-Zip\Lang\lv.txt.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME52.CSS ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Templates\1033\Pitchbook.potx.zhen ioxyfx.dat.exe File created C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.zhen ioxyfx.dat.exe File created C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.zhen ioxyfx.dat.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387895.JPG ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Flow.xml ioxyfx.dat.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm ioxyfx.dat.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Templates\1033\BlackTieResume.dotx.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Black Tie.xml ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145707.JPG ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL093.XML ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImages.jpg ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\UrbanResume.Dotx ioxyfx.dat.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\POSTIT.CFG ioxyfx.dat.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Resource.zip.zhen ioxyfx.dat.exe File created C:\Program Files\VideoLAN\VLC\AUTHORS.txt.zhen ioxyfx.dat.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime.css ioxyfx.dat.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml ioxyfx.dat.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145168.JPG.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate.css ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Elemental.xml.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png ioxyfx.dat.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME18.CSS.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Bibliography\BIBFORM.XML ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL087.XML.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\calendar.css ioxyfx.dat.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png ioxyfx.dat.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\gadget.xml.zhen ioxyfx.dat.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml ioxyfx.dat.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Discussion.css ioxyfx.dat.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\logo.png.zhen ioxyfx.dat.exe File created C:\Program Files\Microsoft Office\Office14\FORMS\1033\SECURE.CFG.zhen ioxyfx.dat.exe -
Drops file in Windows directory 1 IoCs
Processes:
ioxyfx.dat.exedescription ioc process File opened for modification C:\Windows\Web\Wallpaper\Windows\img0.jpg ioxyfx.dat.exe -
Detects Pyinstaller 6 IoCs
Processes:
resource yara_rule \ProgramData\ioxyfx.dat.exe pyinstaller \ProgramData\ioxyfx.dat.exe pyinstaller C:\ProgramData\ioxyfx.dat.exe pyinstaller C:\ProgramData\ioxyfx.dat.exe pyinstaller \ProgramData\ioxyfx.dat.exe pyinstaller \ProgramData\ioxyfx.dat.exe pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2016 208 WerFault.exe x64.exe -
Kills process with taskkill 7 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 1136 taskkill.exe 208 taskkill.exe 224 taskkill.exe 2024 taskkill.exe 1732 taskkill.exe 1644 taskkill.exe 1332 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
ioxyfx.dat.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\ProgramData\\1.bmp" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\TileWallpaper = "0" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\WallpaperStyle = "10" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\OriginalWallpaper = "C:\\ProgramData\\1.bmp" ioxyfx.dat.exe -
Modifies data under HKEY_USERS 17 IoCs
Processes:
ioxyfx.dat.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\ConvertedWallpaper = "C:\\ProgramData\\1.bmp" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1.bmp" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\WallpaperStyle = "10" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1.bmp" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run\TSUGJN = "\"C:\\ProgramData\\ioxyfx.dat.exe\" -ui" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "10" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\TileWallpaper = "0" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\OriginalWallpaper = "C:\\ProgramData\\1.bmp" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\ConvertedWallpaper = "C:\\ProgramData\\1.bmp" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\TileWallpaper = "0" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\WallpaperStyle = "10" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1.bmp" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run\TSUGJN = "\"C:\\ProgramData\\ioxyfx.dat.exe\" -ui" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\OriginalWallpaper = "C:\\ProgramData\\1.bmp" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\OriginalWallpaper = "C:\\ProgramData\\1.bmp" ioxyfx.dat.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\ConvertedWallpaper = "C:\\ProgramData\\1.bmp" ioxyfx.dat.exe -
Modifies registry class 64 IoCs
Processes:
ioxyfx.dat.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1 ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} ioxyfx.dat.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\ProgramData\\MSWINSCK.OCX" ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32 ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\ProgramData\\MSWINSCK.OCX, 1" ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" ioxyfx.dat.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 ioxyfx.dat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\ ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 ioxyfx.dat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS ioxyfx.dat.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
ioxyfx.dat.exex64.exepid process 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 1616 ioxyfx.dat.exe 208 x64.exe 208 x64.exe 208 x64.exe 208 x64.exe 208 x64.exe 208 x64.exe 208 x64.exe 208 x64.exe 208 x64.exe 208 x64.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
vssvc.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetakeown.exex64.exedescription pid process Token: SeBackupPrivilege 1312 vssvc.exe Token: SeRestorePrivilege 1312 vssvc.exe Token: SeAuditPrivilege 1312 vssvc.exe Token: SeDebugPrivilege 224 taskkill.exe Token: SeDebugPrivilege 208 taskkill.exe Token: SeDebugPrivilege 2024 taskkill.exe Token: SeDebugPrivilege 1644 taskkill.exe Token: SeDebugPrivilege 1732 taskkill.exe Token: SeDebugPrivilege 1332 taskkill.exe Token: SeDebugPrivilege 1136 taskkill.exe Token: SeTakeOwnershipPrivilege 548 takeown.exe Token: SeDebugPrivilege 208 x64.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ioxyfx.dat.exeioxyfx.dat.exepid process 1240 ioxyfx.dat.exe 1616 ioxyfx.dat.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
ioxyfx.dat.exeioxyfx.dat.exex64.exedescription pid process target process PID 1240 wrote to memory of 1616 1240 ioxyfx.dat.exe ioxyfx.dat.exe PID 1240 wrote to memory of 1616 1240 ioxyfx.dat.exe ioxyfx.dat.exe PID 1240 wrote to memory of 1616 1240 ioxyfx.dat.exe ioxyfx.dat.exe PID 1240 wrote to memory of 1616 1240 ioxyfx.dat.exe ioxyfx.dat.exe PID 1616 wrote to memory of 1136 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1136 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1136 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1136 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 208 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 208 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 208 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 208 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 224 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 224 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 224 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 224 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 2024 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 2024 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 2024 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 2024 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1732 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1732 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1732 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1732 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1644 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1644 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1644 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1644 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1332 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1332 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1332 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 1332 1616 ioxyfx.dat.exe taskkill.exe PID 1616 wrote to memory of 548 1616 ioxyfx.dat.exe takeown.exe PID 1616 wrote to memory of 548 1616 ioxyfx.dat.exe takeown.exe PID 1616 wrote to memory of 548 1616 ioxyfx.dat.exe takeown.exe PID 1616 wrote to memory of 548 1616 ioxyfx.dat.exe takeown.exe PID 1616 wrote to memory of 1928 1616 ioxyfx.dat.exe icacls.exe PID 1616 wrote to memory of 1928 1616 ioxyfx.dat.exe icacls.exe PID 1616 wrote to memory of 1928 1616 ioxyfx.dat.exe icacls.exe PID 1616 wrote to memory of 1928 1616 ioxyfx.dat.exe icacls.exe PID 1616 wrote to memory of 220 1616 ioxyfx.dat.exe mpcmdrun.exe PID 1616 wrote to memory of 220 1616 ioxyfx.dat.exe mpcmdrun.exe PID 1616 wrote to memory of 220 1616 ioxyfx.dat.exe mpcmdrun.exe PID 1616 wrote to memory of 220 1616 ioxyfx.dat.exe mpcmdrun.exe PID 1616 wrote to memory of 208 1616 ioxyfx.dat.exe x64.exe PID 1616 wrote to memory of 208 1616 ioxyfx.dat.exe x64.exe PID 1616 wrote to memory of 208 1616 ioxyfx.dat.exe x64.exe PID 1616 wrote to memory of 208 1616 ioxyfx.dat.exe x64.exe PID 208 wrote to memory of 2016 208 x64.exe WerFault.exe PID 208 wrote to memory of 2016 208 x64.exe WerFault.exe PID 208 wrote to memory of 2016 208 x64.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ioxyfx.dat.exe"C:\Users\Admin\AppData\Local\Temp\ioxyfx.dat.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\ProgramData\ioxyfx.dat.exeC:\ProgramData\ioxyfx.dat.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Loads dropped DLL
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM MSExchange*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1136 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM Microsoft*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:208 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM ora*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:224 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM tns*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2024 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM mysql*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1732 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM sql*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1644 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM postgres*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1332 -
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /F C:\Windows\Web\Wallpaper\Windows\img0.jpg3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:548 -
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" C:\Windows\Web\Wallpaper\Windows\img0.jpg /grant Users:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1928 -
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -removedefinitions -all3⤵
- Deletes Windows Defender Definitions
PID:220 -
C:\ProgramData\x64.exeC:\ProgramData\x64.exe 04298718c4ed4c0a282605560f30b8f0::72a50cf6d7d1042c8b2514f9768fa499 cfad00e8748eaea::7e9372bd97ed3aec6 25427320e7f946c9::7c3a5807a37a26a9 39d6c0440ea63b::33854dce8ddd35e877 exit3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 208 -s 5564⤵
- Loads dropped DLL
- Program crash
PID:2016
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1312
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d5f9fa1a8dca5319432f51a5891f7794
SHA12a937328f5b99eccb9b8c13ed71d6ffb9dff4521
SHA25618f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055
SHA51287013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0
-
MD5
d5f9fa1a8dca5319432f51a5891f7794
SHA12a937328f5b99eccb9b8c13ed71d6ffb9dff4521
SHA25618f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055
SHA51287013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0
-
MD5
1fc80528461d08dad2d9f234fa971add
SHA11c45209056da5f783cd707e7002597a31befb1c0
SHA25617f606594427c58ff6cdf1270f83aa2595e9168b6cc1618665a1548650a40637
SHA5120a71fd620ac01b031a240450a01af3ce592a228dbfcc74136a680946e36753e5107e8d45bc382baa3f5f30985321f1179fae504e59d13d8f469705b124b96156
-
MD5
1fc80528461d08dad2d9f234fa971add
SHA11c45209056da5f783cd707e7002597a31befb1c0
SHA25617f606594427c58ff6cdf1270f83aa2595e9168b6cc1618665a1548650a40637
SHA5120a71fd620ac01b031a240450a01af3ce592a228dbfcc74136a680946e36753e5107e8d45bc382baa3f5f30985321f1179fae504e59d13d8f469705b124b96156
-
MD5
9484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
MD5
9484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
MD5
9484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
MD5
9484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
MD5
d5f9fa1a8dca5319432f51a5891f7794
SHA12a937328f5b99eccb9b8c13ed71d6ffb9dff4521
SHA25618f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055
SHA51287013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0
-
MD5
d5f9fa1a8dca5319432f51a5891f7794
SHA12a937328f5b99eccb9b8c13ed71d6ffb9dff4521
SHA25618f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055
SHA51287013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0
-
MD5
d5f9fa1a8dca5319432f51a5891f7794
SHA12a937328f5b99eccb9b8c13ed71d6ffb9dff4521
SHA25618f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055
SHA51287013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0
-
MD5
d5f9fa1a8dca5319432f51a5891f7794
SHA12a937328f5b99eccb9b8c13ed71d6ffb9dff4521
SHA25618f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055
SHA51287013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0
-
MD5
1fc80528461d08dad2d9f234fa971add
SHA11c45209056da5f783cd707e7002597a31befb1c0
SHA25617f606594427c58ff6cdf1270f83aa2595e9168b6cc1618665a1548650a40637
SHA5120a71fd620ac01b031a240450a01af3ce592a228dbfcc74136a680946e36753e5107e8d45bc382baa3f5f30985321f1179fae504e59d13d8f469705b124b96156
-
MD5
1fc80528461d08dad2d9f234fa971add
SHA11c45209056da5f783cd707e7002597a31befb1c0
SHA25617f606594427c58ff6cdf1270f83aa2595e9168b6cc1618665a1548650a40637
SHA5120a71fd620ac01b031a240450a01af3ce592a228dbfcc74136a680946e36753e5107e8d45bc382baa3f5f30985321f1179fae504e59d13d8f469705b124b96156
-
MD5
1fc80528461d08dad2d9f234fa971add
SHA11c45209056da5f783cd707e7002597a31befb1c0
SHA25617f606594427c58ff6cdf1270f83aa2595e9168b6cc1618665a1548650a40637
SHA5120a71fd620ac01b031a240450a01af3ce592a228dbfcc74136a680946e36753e5107e8d45bc382baa3f5f30985321f1179fae504e59d13d8f469705b124b96156
-
MD5
1fc80528461d08dad2d9f234fa971add
SHA11c45209056da5f783cd707e7002597a31befb1c0
SHA25617f606594427c58ff6cdf1270f83aa2595e9168b6cc1618665a1548650a40637
SHA5120a71fd620ac01b031a240450a01af3ce592a228dbfcc74136a680946e36753e5107e8d45bc382baa3f5f30985321f1179fae504e59d13d8f469705b124b96156
-
MD5
1fc80528461d08dad2d9f234fa971add
SHA11c45209056da5f783cd707e7002597a31befb1c0
SHA25617f606594427c58ff6cdf1270f83aa2595e9168b6cc1618665a1548650a40637
SHA5120a71fd620ac01b031a240450a01af3ce592a228dbfcc74136a680946e36753e5107e8d45bc382baa3f5f30985321f1179fae504e59d13d8f469705b124b96156