Analysis
-
max time kernel
385s -
max time network
394s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
01-08-2022 10:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.fsoft.it/FSPViewer/dwn-files/FSPViewer-2.1.0-Setup.exe
Resource
win7-20220715-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://www.fsoft.it/FSPViewer/dwn-files/FSPViewer-2.1.0-Setup.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
http://www.fsoft.it/FSPViewer/dwn-files/FSPViewer-2.1.0-Setup.exe
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 007b1c2690a5d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366114120" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0008553890a5d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5EED4771-1183-11ED-9CA0-76562B5EEE6A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e528c10875d4b347a30c038b2e32007f00000000020000000000106600000001000020000000aea2bf4dffe1b640d16a49e14228b396b5b680a01447aaba944fd3e9ac4dccec000000000e8000000002000020000000073769d34526efcdcf4e17ac9a7a599223da410e92073fcd45a59bbff2dd674990000000edfd2997822a477844b5cb2969fd5430951ad7510007c7fee0ea4d5353d8054f96eec88a212a3075efddbe067331c8760d7a5ab7261e9ee2f1b16fecf5d9e9edcd5fd5ec435a2d6318b969e141ed5547863354274ebf22b484ca4a6d0ec404243cf5ad5d7ea0792b61bf548b38b0e762720e895d7551c757a54c58111aa49354b24ab7fc3b7ca637b4c5e6418913f897400000003854689cccbbe8dbd19c3c0ba76a0c6b2cfd9a4ac21a0ab4870e61cfb2029fde63ec9624b5b9ce03ed88c387fc2d5be0c206a7bed874bf4a864689723d3d3fd7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e528c10875d4b347a30c038b2e32007f00000000020000000000106600000001000020000000a238b54c6050b8e7229c15e4ceafca628de120d814e97854a246ec0894695dd9000000000e8000000002000020000000dcb470118f98141c7f150577aa3812b086bb0f119b422a92b38287a0e02d42e8200000006e84dd53206dbce0f003ecb36aa69bb27d82170f0fb0713bf71957f80e5d2c4d40000000084d9f20d5c45bcb3c5b15304c6be955c25732297478aadddd5b6fe68846f45c8090a5ad5ac2e8448e7ea35b3930ef98df152dff2b3f1a4fa433ca17fd1f074f iexplore.exe -
Modifies registry class 50 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "2" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_Classes\Local Settings chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" chrome.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 672 chrome.exe 1748 chrome.exe 1748 chrome.exe 2708 chrome.exe 2788 chrome.exe 1748 chrome.exe 1748 chrome.exe 1700 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1700 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1956 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1956 AUDIODG.EXE Token: 33 1956 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1956 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 1064 iexplore.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1064 iexplore.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe 1748 chrome.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1064 iexplore.exe 1064 iexplore.exe 960 IEXPLORE.EXE 960 IEXPLORE.EXE 1700 chrome.exe 1700 chrome.exe 1700 chrome.exe 1700 chrome.exe 1700 chrome.exe 1700 chrome.exe 1700 chrome.exe 1700 chrome.exe 1700 chrome.exe 1700 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1064 wrote to memory of 960 1064 iexplore.exe 28 PID 1064 wrote to memory of 960 1064 iexplore.exe 28 PID 1064 wrote to memory of 960 1064 iexplore.exe 28 PID 1064 wrote to memory of 960 1064 iexplore.exe 28 PID 1748 wrote to memory of 1872 1748 chrome.exe 31 PID 1748 wrote to memory of 1872 1748 chrome.exe 31 PID 1748 wrote to memory of 1872 1748 chrome.exe 31 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 1588 1748 chrome.exe 32 PID 1748 wrote to memory of 672 1748 chrome.exe 33 PID 1748 wrote to memory of 672 1748 chrome.exe 33 PID 1748 wrote to memory of 672 1748 chrome.exe 33 PID 1748 wrote to memory of 1676 1748 chrome.exe 34 PID 1748 wrote to memory of 1676 1748 chrome.exe 34 PID 1748 wrote to memory of 1676 1748 chrome.exe 34 PID 1748 wrote to memory of 1676 1748 chrome.exe 34 PID 1748 wrote to memory of 1676 1748 chrome.exe 34 PID 1748 wrote to memory of 1676 1748 chrome.exe 34 PID 1748 wrote to memory of 1676 1748 chrome.exe 34 PID 1748 wrote to memory of 1676 1748 chrome.exe 34 PID 1748 wrote to memory of 1676 1748 chrome.exe 34 PID 1748 wrote to memory of 1676 1748 chrome.exe 34 PID 1748 wrote to memory of 1676 1748 chrome.exe 34 PID 1748 wrote to memory of 1676 1748 chrome.exe 34 PID 1748 wrote to memory of 1676 1748 chrome.exe 34
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.fsoft.it/FSPViewer/dwn-files/FSPViewer-2.1.0-Setup.exe1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6764f50,0x7fef6764f60,0x7fef6764f702⤵PID:1872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1036 /prefetch:22⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1388 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 /prefetch:82⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:12⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:12⤵PID:1840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:82⤵PID:2052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1032 /prefetch:22⤵PID:2140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3544 /prefetch:82⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3584 /prefetch:82⤵PID:2256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3964 /prefetch:82⤵PID:2352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:12⤵PID:2392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:12⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=540 /prefetch:82⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3288 /prefetch:82⤵PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=616 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1988 /prefetch:82⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3544 /prefetch:82⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3092 /prefetch:82⤵PID:2904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:12⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:82⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=988 /prefetch:82⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:12⤵PID:528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2380 /prefetch:12⤵PID:1452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3428 /prefetch:82⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1028,3577591006587386924,10104541594778732495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:82⤵PID:2068
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1964
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1b41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
606B
MD5b2c97e78556d31a6ed1a82e940e8bc1b
SHA1474431f41cb8bc065f69d82e0307b507b5df3c6e
SHA2565a1cffa97c3fa032fc07faaf2867ff52ddae4a62f2709ab0b40f1e5504cdf09d
SHA5124ef37029ef54abce3250906ccc0e512478cd5b98a6333ca23cada619b331f82213a599a7991ac2ccbe27ce0364274ed6c7b3a1ceee145a62cb738aadecd90df0
-
Filesize
3.1MB
MD5b6c9cfc580079ca089d662b42a2fa083
SHA1c509b0859e061faa6cf1299e738d1fba9772435f
SHA2562585f43a14cb9aa300f44d43d0abeecedf055690ee7d38f6f1f5e2d2d137d1aa
SHA512f9e502b38de536cb3750a47e5355a0b8c3371c99b541632bd45d3d59adb32b675ac834d69afaa0751236ccad6b4af19817099771d53d57806f7503ab39776292