Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18/10/2022, 21:20
Behavioral task
behavioral1
Sample
ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe
Resource
win7-20220812-en
windows7-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
27 signatures
150 seconds
General
-
Target
ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe
-
Size
236KB
-
MD5
f939bf75f63371ca206f31ab06145efd
-
SHA1
54a876db09f4bb36ace0e77a1633802f33585704
-
SHA256
ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee
-
SHA512
082ddd59f55dcf562284d2e24ee1c96efe88b38beeb1c1df3e9b1b30dfa815693cb6fc9d6b68b089b86dc27e7d2db9daa02c9cd36887071f197924aa0512342b
-
SSDEEP
1536:2DusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:Vox6AHjYzaFXg+w17jsgS/jHagQg1E5
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe -
Disables use of System Restore points 1 TTPs
-
Drops file in Drivers directory 24 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created C:\Windows\SysWOW64\drivers\system32.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe -
Executes dropped EXE 30 IoCs
pid Process 900 smss.exe 1656 smss.exe 964 Gaara.exe 704 smss.exe 276 Gaara.exe 1528 csrss.exe 1668 smss.exe 1620 Gaara.exe 1004 csrss.exe 360 Kazekage.exe 1080 smss.exe 1064 Gaara.exe 1984 csrss.exe 1936 Kazekage.exe 1960 system32.exe 976 smss.exe 1840 Gaara.exe 1416 csrss.exe 776 Kazekage.exe 1636 system32.exe 1952 system32.exe 1736 Kazekage.exe 2012 system32.exe 1264 csrss.exe 1260 Kazekage.exe 940 system32.exe 880 Gaara.exe 308 csrss.exe 1500 Kazekage.exe 1168 system32.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe smss.exe -
resource yara_rule behavioral1/files/0x00060000000149b7-57.dat upx behavioral1/files/0x00060000000149b7-58.dat upx behavioral1/files/0x00060000000149b7-60.dat upx behavioral1/files/0x0006000000014c4a-72.dat upx behavioral1/files/0x0006000000014baa-71.dat upx behavioral1/files/0x00060000000149b7-76.dat upx behavioral1/files/0x0006000000014b6f-70.dat upx behavioral1/files/0x0006000000014af2-69.dat upx behavioral1/files/0x0006000000014ab0-68.dat upx behavioral1/files/0x00060000000149b7-67.dat upx behavioral1/memory/1656-81-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000014ab0-82.dat upx behavioral1/files/0x0006000000014ab0-83.dat upx behavioral1/files/0x0006000000014ab0-85.dat upx behavioral1/files/0x0006000000014c4a-95.dat upx behavioral1/files/0x0006000000014baa-94.dat upx behavioral1/files/0x0006000000014b6f-93.dat upx behavioral1/files/0x0006000000014af2-92.dat upx behavioral1/memory/1824-101-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x00060000000149b7-100.dat upx behavioral1/files/0x00060000000149b7-98.dat upx behavioral1/files/0x0006000000014ab0-91.dat upx behavioral1/memory/900-105-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/964-107-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/704-110-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000014ab0-111.dat upx behavioral1/memory/276-116-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000014af2-117.dat upx behavioral1/files/0x0006000000014af2-118.dat upx behavioral1/files/0x0006000000014af2-120.dat upx behavioral1/files/0x0006000000014af2-126.dat upx behavioral1/files/0x0006000000014baa-128.dat upx behavioral1/files/0x0006000000014c4a-129.dat upx behavioral1/files/0x0006000000014b6f-127.dat upx behavioral1/files/0x00060000000149b7-134.dat upx behavioral1/files/0x00060000000149b7-132.dat upx behavioral1/memory/1668-141-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000014ab0-139.dat upx behavioral1/files/0x0006000000014ab0-142.dat upx behavioral1/memory/1620-148-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000014af2-149.dat upx behavioral1/memory/1004-154-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000014baa-155.dat upx behavioral1/files/0x0006000000014baa-156.dat upx behavioral1/files/0x0006000000014baa-158.dat upx behavioral1/files/0x0006000000014baa-163.dat upx behavioral1/files/0x0006000000014b6f-164.dat upx behavioral1/files/0x00060000000149b7-170.dat upx behavioral1/memory/360-172-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x00060000000149b7-173.dat upx behavioral1/memory/1528-169-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000014c4a-165.dat upx behavioral1/memory/1080-178-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1064-184-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1984-189-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1936-193-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/976-203-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1840-208-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1416-212-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/776-218-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1636-222-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1952-228-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1736-232-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1960-241-0x0000000000400000-0x000000000043B000-memory.dmp upx -
Loads dropped DLL 60 IoCs
pid Process 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 900 smss.exe 1656 smss.exe 900 smss.exe 900 smss.exe 964 Gaara.exe 964 Gaara.exe 704 smss.exe 276 Gaara.exe 964 Gaara.exe 964 Gaara.exe 1528 csrss.exe 1528 csrss.exe 1668 smss.exe 1528 csrss.exe 1620 Gaara.exe 1004 csrss.exe 1528 csrss.exe 1528 csrss.exe 360 Kazekage.exe 1080 smss.exe 360 Kazekage.exe 1064 Gaara.exe 360 Kazekage.exe 1984 csrss.exe 360 Kazekage.exe 360 Kazekage.exe 360 Kazekage.exe 360 Kazekage.exe 1960 system32.exe 976 smss.exe 1960 system32.exe 1840 Gaara.exe 1960 system32.exe 1416 csrss.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 1528 csrss.exe 1528 csrss.exe 964 Gaara.exe 964 Gaara.exe 964 Gaara.exe 964 Gaara.exe 900 smss.exe 1264 csrss.exe 900 smss.exe 900 smss.exe 900 smss.exe 900 smss.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 880 Gaara.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 308 csrss.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe -
Adds Run key to start application 2 TTPs 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 18 - 10 - 2022\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 18 - 10 - 2022\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 18 - 10 - 2022\\Gaara.exe" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 18 - 10 - 2022\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "18-10-2022.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 18 - 10 - 2022\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 18 - 10 - 2022\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 18 - 10 - 2022\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 18 - 10 - 2022\\smss.exe" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 18 - 10 - 2022\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 18 - 10 - 2022\\smss.exe" Kazekage.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Kazekage.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "18-10-2022.exe" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "18-10-2022.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "18-10-2022.exe" smss.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "18-10-2022.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 18 - 10 - 2022\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "18-10-2022.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 18 - 10 - 2022\\smss.exe" system32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\R:\Desktop.ini smss.exe File opened for modification \??\L:\Desktop.ini Gaara.exe File opened for modification \??\K:\Desktop.ini csrss.exe File opened for modification \??\Y:\Desktop.ini csrss.exe File opened for modification \??\H:\Desktop.ini ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\I:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini smss.exe File opened for modification \??\T:\Desktop.ini smss.exe File opened for modification \??\V:\Desktop.ini Gaara.exe File opened for modification \??\M:\Desktop.ini Kazekage.exe File opened for modification \??\U:\Desktop.ini csrss.exe File opened for modification \??\F:\Desktop.ini ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\B:\Desktop.ini system32.exe File opened for modification C:\Desktop.ini system32.exe File opened for modification \??\F:\Desktop.ini csrss.exe File opened for modification C:\Desktop.ini ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\H:\Desktop.ini system32.exe File opened for modification \??\W:\Desktop.ini smss.exe File opened for modification \??\X:\Desktop.ini Gaara.exe File opened for modification \??\K:\Desktop.ini Kazekage.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\T:\Desktop.ini system32.exe File opened for modification \??\Q:\Desktop.ini smss.exe File opened for modification \??\U:\Desktop.ini smss.exe File opened for modification \??\U:\Desktop.ini system32.exe File opened for modification \??\L:\Desktop.ini smss.exe File opened for modification \??\O:\Desktop.ini Gaara.exe File opened for modification \??\S:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\M:\Desktop.ini ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\R:\Desktop.ini system32.exe File opened for modification \??\A:\Desktop.ini smss.exe File opened for modification \??\G:\Desktop.ini system32.exe File opened for modification \??\N:\Desktop.ini smss.exe File opened for modification \??\G:\Desktop.ini Gaara.exe File opened for modification \??\Q:\Desktop.ini Gaara.exe File opened for modification \??\W:\Desktop.ini Gaara.exe File opened for modification \??\Z:\Desktop.ini ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\E:\Desktop.ini smss.exe File opened for modification \??\P:\Desktop.ini system32.exe File opened for modification \??\H:\Desktop.ini Gaara.exe File opened for modification C:\Desktop.ini Gaara.exe File opened for modification \??\Y:\Desktop.ini Kazekage.exe File opened for modification \??\F:\Desktop.ini system32.exe File opened for modification \??\O:\Desktop.ini smss.exe File opened for modification \??\Z:\Desktop.ini smss.exe File opened for modification \??\O:\Desktop.ini Kazekage.exe File opened for modification \??\W:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini Kazekage.exe File opened for modification \??\L:\Desktop.ini csrss.exe File opened for modification \??\V:\Desktop.ini csrss.exe File opened for modification \??\I:\Desktop.ini system32.exe File opened for modification \??\J:\Desktop.ini smss.exe File opened for modification \??\H:\Desktop.ini csrss.exe File opened for modification \??\V:\Desktop.ini ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\K:\Desktop.ini Gaara.exe File opened for modification \??\J:\Desktop.ini csrss.exe File opened for modification \??\N:\Desktop.ini csrss.exe File opened for modification \??\O:\Desktop.ini system32.exe File opened for modification \??\I:\Desktop.ini Gaara.exe File opened for modification C:\Desktop.ini Kazekage.exe File opened for modification \??\O:\Desktop.ini csrss.exe File opened for modification \??\T:\Desktop.ini csrss.exe File opened for modification \??\A:\Desktop.ini Kazekage.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\A: smss.exe File opened (read-only) \??\W: system32.exe File opened (read-only) \??\F: Kazekage.exe File opened (read-only) \??\H: ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened (read-only) \??\O: system32.exe File opened (read-only) \??\R: smss.exe File opened (read-only) \??\P: Gaara.exe File opened (read-only) \??\Y: Gaara.exe File opened (read-only) \??\Z: Gaara.exe File opened (read-only) \??\E: Kazekage.exe File opened (read-only) \??\W: ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened (read-only) \??\L: smss.exe File opened (read-only) \??\S: Kazekage.exe File opened (read-only) \??\E: Gaara.exe File opened (read-only) \??\H: Gaara.exe File opened (read-only) \??\R: Kazekage.exe File opened (read-only) \??\R: csrss.exe File opened (read-only) \??\N: Kazekage.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\J: Kazekage.exe File opened (read-only) \??\P: csrss.exe File opened (read-only) \??\L: ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened (read-only) \??\A: system32.exe File opened (read-only) \??\B: smss.exe File opened (read-only) \??\U: ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened (read-only) \??\P: smss.exe File opened (read-only) \??\B: Kazekage.exe File opened (read-only) \??\X: Kazekage.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\I: ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened (read-only) \??\E: system32.exe File opened (read-only) \??\X: system32.exe File opened (read-only) \??\L: csrss.exe File opened (read-only) \??\T: csrss.exe File opened (read-only) \??\M: ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened (read-only) \??\Q: smss.exe File opened (read-only) \??\W: Gaara.exe File opened (read-only) \??\I: system32.exe File opened (read-only) \??\J: Gaara.exe File opened (read-only) \??\K: Gaara.exe File opened (read-only) \??\U: Gaara.exe File opened (read-only) \??\V: Gaara.exe File opened (read-only) \??\X: Gaara.exe File opened (read-only) \??\M: csrss.exe File opened (read-only) \??\N: ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened (read-only) \??\T: smss.exe File opened (read-only) \??\W: smss.exe File opened (read-only) \??\M: Kazekage.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\R: system32.exe File opened (read-only) \??\S: smss.exe File opened (read-only) \??\V: smss.exe File opened (read-only) \??\K: Kazekage.exe File opened (read-only) \??\Q: csrss.exe File opened (read-only) \??\K: system32.exe File opened (read-only) \??\L: system32.exe File opened (read-only) \??\T: Gaara.exe File opened (read-only) \??\Q: Kazekage.exe File opened (read-only) \??\Y: Kazekage.exe File opened (read-only) \??\F: csrss.exe File opened (read-only) \??\U: csrss.exe File opened (read-only) \??\R: ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened (read-only) \??\K: smss.exe -
Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\U:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created \??\V:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\I:\Autorun.inf system32.exe File created \??\W:\Autorun.inf smss.exe File created \??\K:\Autorun.inf Gaara.exe File created \??\I:\Autorun.inf smss.exe File opened for modification \??\V:\Autorun.inf Gaara.exe File created \??\R:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\V:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created \??\I:\Autorun.inf csrss.exe File opened for modification \??\V:\Autorun.inf system32.exe File opened for modification \??\A:\Autorun.inf Kazekage.exe File opened for modification \??\S:\Autorun.inf Kazekage.exe File opened for modification \??\O:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\F:\Autorun.inf Kazekage.exe File created \??\P:\Autorun.inf Gaara.exe File created \??\W:\Autorun.inf Gaara.exe File created \??\E:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\G:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created \??\H:\Autorun.inf csrss.exe File opened for modification \??\N:\Autorun.inf system32.exe File created \??\V:\Autorun.inf smss.exe File opened for modification \??\R:\Autorun.inf Gaara.exe File opened for modification \??\K:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created \??\Q:\Autorun.inf Kazekage.exe File created \??\J:\Autorun.inf Gaara.exe File created \??\S:\Autorun.inf Gaara.exe File opened for modification \??\T:\Autorun.inf Gaara.exe File opened for modification \??\R:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created \??\T:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created \??\Y:\Autorun.inf csrss.exe File created \??\E:\Autorun.inf Kazekage.exe File opened for modification \??\Q:\Autorun.inf Kazekage.exe File opened for modification \??\X:\Autorun.inf Kazekage.exe File created \??\U:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created \??\G:\Autorun.inf csrss.exe File opened for modification \??\F:\Autorun.inf system32.exe File created \??\X:\Autorun.inf system32.exe File created \??\S:\Autorun.inf Kazekage.exe File created C:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\L:\Autorun.inf system32.exe File created \??\G:\Autorun.inf Kazekage.exe File created \??\Y:\Autorun.inf smss.exe File opened for modification \??\P:\Autorun.inf csrss.exe File created \??\J:\Autorun.inf system32.exe File opened for modification \??\K:\Autorun.inf smss.exe File created \??\W:\Autorun.inf csrss.exe File opened for modification \??\Y:\Autorun.inf csrss.exe File opened for modification \??\H:\Autorun.inf system32.exe File opened for modification \??\X:\Autorun.inf system32.exe File opened for modification \??\Z:\Autorun.inf Kazekage.exe File created \??\G:\Autorun.inf smss.exe File created D:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification \??\Q:\Autorun.inf smss.exe File created \??\P:\Autorun.inf ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created \??\U:\Autorun.inf csrss.exe File created \??\U:\Autorun.inf system32.exe File opened for modification \??\F:\Autorun.inf smss.exe File created \??\S:\Autorun.inf smss.exe File created D:\Autorun.inf Gaara.exe File opened for modification \??\H:\Autorun.inf csrss.exe File opened for modification \??\K:\Autorun.inf csrss.exe File opened for modification \??\U:\Autorun.inf Kazekage.exe File created \??\B:\Autorun.inf Gaara.exe -
Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\18-10-2022.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\SysWOW64\18-10-2022.exe smss.exe File opened for modification C:\Windows\SysWOW64\18-10-2022.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\18-10-2022.exe csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File created C:\Windows\SysWOW64\18-10-2022.exe csrss.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\18-10-2022.exe Kazekage.exe File created C:\Windows\SysWOW64\Desktop.ini ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\SysWOW64\ ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File created C:\Windows\SysWOW64\18-10-2022.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\SysWOW64\18-10-2022.exe system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe -
Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system\mscoree.dll ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe smss.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\msvbvm60.dll ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe Gaara.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe csrss.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe system32.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe smss.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx Kazekage.exe File created C:\Windows\mscomctl.ocx ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe Gaara.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File created C:\Windows\WBEM\msvbvm60.dll system32.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created C:\Windows\WBEM\msvbvm60.dll smss.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe system32.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe Kazekage.exe File opened for modification C:\Windows\ Gaara.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\msvbvm60.dll ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created C:\Windows\WBEM\msvbvm60.dll ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe smss.exe File created C:\Windows\WBEM\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg csrss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe csrss.exe File opened for modification C:\Windows\ smss.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe system32.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\msvbvm60.dll system32.exe File opened for modification C:\Windows\ ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\ csrss.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe File opened for modification C:\Windows\ system32.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe csrss.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe File opened for modification C:\Windows\msvbvm60.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2022\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe -
Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Speed = "4" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" system32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee system32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Size = "72" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WallpaperStyle = "2" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Size = "72" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main system32.exe -
Modifies registry class 48 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe -
Runs ping.exe 1 TTPs 28 IoCs
pid Process 1948 ping.exe 1468 ping.exe 436 ping.exe 1264 ping.exe 1948 ping.exe 1916 ping.exe 1460 ping.exe 1916 ping.exe 1416 ping.exe 1516 ping.exe 840 ping.exe 1356 ping.exe 636 ping.exe 1252 ping.exe 1532 ping.exe 1312 ping.exe 1412 ping.exe 1072 ping.exe 2012 ping.exe 1076 ping.exe 320 ping.exe 2012 ping.exe 1540 ping.exe 1532 ping.exe 560 ping.exe 1640 ping.exe 1924 ping.exe 1076 ping.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1528 csrss.exe 1528 csrss.exe 1528 csrss.exe 1528 csrss.exe 1528 csrss.exe 1528 csrss.exe 1528 csrss.exe 1528 csrss.exe 1528 csrss.exe 1528 csrss.exe 1528 csrss.exe 1528 csrss.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 900 smss.exe 900 smss.exe 900 smss.exe 900 smss.exe 900 smss.exe 900 smss.exe 900 smss.exe 900 smss.exe 900 smss.exe 900 smss.exe 900 smss.exe 900 smss.exe 964 Gaara.exe 964 Gaara.exe 964 Gaara.exe 964 Gaara.exe 964 Gaara.exe 964 Gaara.exe 964 Gaara.exe 964 Gaara.exe 964 Gaara.exe 964 Gaara.exe 964 Gaara.exe 964 Gaara.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe 1960 system32.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 900 smss.exe 1656 smss.exe 964 Gaara.exe 704 smss.exe 276 Gaara.exe 1528 csrss.exe 1668 smss.exe 1620 Gaara.exe 1004 csrss.exe 360 Kazekage.exe 1080 smss.exe 1064 Gaara.exe 1984 csrss.exe 1936 Kazekage.exe 1960 system32.exe 976 smss.exe 1840 Gaara.exe 1416 csrss.exe 776 Kazekage.exe 1636 system32.exe 1952 system32.exe 1736 Kazekage.exe 2012 system32.exe 1264 csrss.exe 1260 Kazekage.exe 940 system32.exe 880 Gaara.exe 308 csrss.exe 1500 Kazekage.exe 1168 system32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1824 wrote to memory of 900 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 27 PID 1824 wrote to memory of 900 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 27 PID 1824 wrote to memory of 900 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 27 PID 1824 wrote to memory of 900 1824 ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe 27 PID 900 wrote to memory of 1656 900 smss.exe 28 PID 900 wrote to memory of 1656 900 smss.exe 28 PID 900 wrote to memory of 1656 900 smss.exe 28 PID 900 wrote to memory of 1656 900 smss.exe 28 PID 900 wrote to memory of 964 900 smss.exe 29 PID 900 wrote to memory of 964 900 smss.exe 29 PID 900 wrote to memory of 964 900 smss.exe 29 PID 900 wrote to memory of 964 900 smss.exe 29 PID 964 wrote to memory of 704 964 Gaara.exe 30 PID 964 wrote to memory of 704 964 Gaara.exe 30 PID 964 wrote to memory of 704 964 Gaara.exe 30 PID 964 wrote to memory of 704 964 Gaara.exe 30 PID 964 wrote to memory of 276 964 Gaara.exe 31 PID 964 wrote to memory of 276 964 Gaara.exe 31 PID 964 wrote to memory of 276 964 Gaara.exe 31 PID 964 wrote to memory of 276 964 Gaara.exe 31 PID 964 wrote to memory of 1528 964 Gaara.exe 32 PID 964 wrote to memory of 1528 964 Gaara.exe 32 PID 964 wrote to memory of 1528 964 Gaara.exe 32 PID 964 wrote to memory of 1528 964 Gaara.exe 32 PID 1528 wrote to memory of 1668 1528 csrss.exe 33 PID 1528 wrote to memory of 1668 1528 csrss.exe 33 PID 1528 wrote to memory of 1668 1528 csrss.exe 33 PID 1528 wrote to memory of 1668 1528 csrss.exe 33 PID 1528 wrote to memory of 1620 1528 csrss.exe 34 PID 1528 wrote to memory of 1620 1528 csrss.exe 34 PID 1528 wrote to memory of 1620 1528 csrss.exe 34 PID 1528 wrote to memory of 1620 1528 csrss.exe 34 PID 1528 wrote to memory of 1004 1528 csrss.exe 35 PID 1528 wrote to memory of 1004 1528 csrss.exe 35 PID 1528 wrote to memory of 1004 1528 csrss.exe 35 PID 1528 wrote to memory of 1004 1528 csrss.exe 35 PID 1528 wrote to memory of 360 1528 csrss.exe 36 PID 1528 wrote to memory of 360 1528 csrss.exe 36 PID 1528 wrote to memory of 360 1528 csrss.exe 36 PID 1528 wrote to memory of 360 1528 csrss.exe 36 PID 360 wrote to memory of 1080 360 Kazekage.exe 37 PID 360 wrote to memory of 1080 360 Kazekage.exe 37 PID 360 wrote to memory of 1080 360 Kazekage.exe 37 PID 360 wrote to memory of 1080 360 Kazekage.exe 37 PID 360 wrote to memory of 1064 360 Kazekage.exe 38 PID 360 wrote to memory of 1064 360 Kazekage.exe 38 PID 360 wrote to memory of 1064 360 Kazekage.exe 38 PID 360 wrote to memory of 1064 360 Kazekage.exe 38 PID 360 wrote to memory of 1984 360 Kazekage.exe 39 PID 360 wrote to memory of 1984 360 Kazekage.exe 39 PID 360 wrote to memory of 1984 360 Kazekage.exe 39 PID 360 wrote to memory of 1984 360 Kazekage.exe 39 PID 360 wrote to memory of 1936 360 Kazekage.exe 40 PID 360 wrote to memory of 1936 360 Kazekage.exe 40 PID 360 wrote to memory of 1936 360 Kazekage.exe 40 PID 360 wrote to memory of 1936 360 Kazekage.exe 40 PID 360 wrote to memory of 1960 360 Kazekage.exe 41 PID 360 wrote to memory of 1960 360 Kazekage.exe 41 PID 360 wrote to memory of 1960 360 Kazekage.exe 41 PID 360 wrote to memory of 1960 360 Kazekage.exe 41 PID 1960 wrote to memory of 976 1960 system32.exe 42 PID 1960 wrote to memory of 976 1960 system32.exe 42 PID 1960 wrote to memory of 976 1960 system32.exe 42 PID 1960 wrote to memory of 976 1960 system32.exe 42 -
System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe"C:\Users\Admin\AppData\Local\Temp\ddc5d8e7557d22951c4ade95286786564bc1a53cb45b14d6b7da54036a1564ee.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1824 -
C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:900 -
C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1656
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:964 -
C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:704
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:276
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1528 -
C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1668
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1004
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:360 -
C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1080
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1064
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1936
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1960 -
C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:976
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1840
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1416
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:776
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1636
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:1916
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:2012
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:1312
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:1924
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:1948
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:1356
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:1252
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:1072
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:1916
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:1460
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:1412
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:560
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1532
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:320
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1948
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:436
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1076
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1532
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2012
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:1640
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:1468
-
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1264
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1260
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:940
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:1540
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:1416
-
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:880
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2022\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:308
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1500
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1168
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:1076
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:636
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:1516
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2012
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:1264
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:840
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Bypass User Account Control
1Disabling Security Tools
1Hidden Files and Directories
2Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5884dc7bc416a36cf6eb90ecdf6291bb2
SHA1e350cfa73b3ec1aa79aa75d6416322ce34c78f35
SHA256c25938faeb23db391e1eaf2072dd56463421072c26e9477051d22ea98e58de74
SHA5122c5b609c1cf1ca6c44e623dba084cf661430cc5857c374359fe9ff2b5616894b643d460e1a505af865f91ab58524bf533251934eb57e04cc4cb91ad432ab79cd
-
Filesize
236KB
MD5884dc7bc416a36cf6eb90ecdf6291bb2
SHA1e350cfa73b3ec1aa79aa75d6416322ce34c78f35
SHA256c25938faeb23db391e1eaf2072dd56463421072c26e9477051d22ea98e58de74
SHA5122c5b609c1cf1ca6c44e623dba084cf661430cc5857c374359fe9ff2b5616894b643d460e1a505af865f91ab58524bf533251934eb57e04cc4cb91ad432ab79cd
-
Filesize
236KB
MD5884dc7bc416a36cf6eb90ecdf6291bb2
SHA1e350cfa73b3ec1aa79aa75d6416322ce34c78f35
SHA256c25938faeb23db391e1eaf2072dd56463421072c26e9477051d22ea98e58de74
SHA5122c5b609c1cf1ca6c44e623dba084cf661430cc5857c374359fe9ff2b5616894b643d460e1a505af865f91ab58524bf533251934eb57e04cc4cb91ad432ab79cd
-
Filesize
236KB
MD5884dc7bc416a36cf6eb90ecdf6291bb2
SHA1e350cfa73b3ec1aa79aa75d6416322ce34c78f35
SHA256c25938faeb23db391e1eaf2072dd56463421072c26e9477051d22ea98e58de74
SHA5122c5b609c1cf1ca6c44e623dba084cf661430cc5857c374359fe9ff2b5616894b643d460e1a505af865f91ab58524bf533251934eb57e04cc4cb91ad432ab79cd
-
Filesize
236KB
MD5884dc7bc416a36cf6eb90ecdf6291bb2
SHA1e350cfa73b3ec1aa79aa75d6416322ce34c78f35
SHA256c25938faeb23db391e1eaf2072dd56463421072c26e9477051d22ea98e58de74
SHA5122c5b609c1cf1ca6c44e623dba084cf661430cc5857c374359fe9ff2b5616894b643d460e1a505af865f91ab58524bf533251934eb57e04cc4cb91ad432ab79cd
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
236KB
MD58c49cac5de9f2c7e55df519dc6c499b5
SHA11b555511d069648949222daffd7c7b0e4b0d1c67
SHA256a5a271124e896360b717498ceb623725a709b00062403009d9fa9693fb7d0cd0
SHA512852be3c7af56512690b7ff7eceaec2ed0886e1a17d98e904f6efae4973c551438738db7f765bca21aeee4709b42071417d8cf82e9c62c22a9f09169118fcebc0
-
Filesize
236KB
MD58c49cac5de9f2c7e55df519dc6c499b5
SHA11b555511d069648949222daffd7c7b0e4b0d1c67
SHA256a5a271124e896360b717498ceb623725a709b00062403009d9fa9693fb7d0cd0
SHA512852be3c7af56512690b7ff7eceaec2ed0886e1a17d98e904f6efae4973c551438738db7f765bca21aeee4709b42071417d8cf82e9c62c22a9f09169118fcebc0
-
Filesize
236KB
MD58c49cac5de9f2c7e55df519dc6c499b5
SHA11b555511d069648949222daffd7c7b0e4b0d1c67
SHA256a5a271124e896360b717498ceb623725a709b00062403009d9fa9693fb7d0cd0
SHA512852be3c7af56512690b7ff7eceaec2ed0886e1a17d98e904f6efae4973c551438738db7f765bca21aeee4709b42071417d8cf82e9c62c22a9f09169118fcebc0
-
Filesize
236KB
MD57a676acecd5c1d9956d6606091310785
SHA10e5adf17c55d7a965a7e369c457f75c4e377792d
SHA25668124c5b8df054770169b6268c7a85ae41aed8d1bc8a6c6e6684fcdc11d53c95
SHA512aa3580ddcb87c05d90b97d322b7dbfb7a155a1b5a1246c364cc236c032a8459e8213c53cfd1ec4981b835fe1a0425c84eab771917a2bbe8e5ceb34dd76bfba67
-
Filesize
236KB
MD58c49cac5de9f2c7e55df519dc6c499b5
SHA11b555511d069648949222daffd7c7b0e4b0d1c67
SHA256a5a271124e896360b717498ceb623725a709b00062403009d9fa9693fb7d0cd0
SHA512852be3c7af56512690b7ff7eceaec2ed0886e1a17d98e904f6efae4973c551438738db7f765bca21aeee4709b42071417d8cf82e9c62c22a9f09169118fcebc0
-
Filesize
236KB
MD588b796b900e03e2b0beaad0ccccee384
SHA1be4840f0fa330440363f0a1a3c52b4f70a2eb253
SHA256443c53a146dda33a10df2a50a07403f5b9c15a592cd9bec3c86ce8b5ec3c84d9
SHA512e877319babf9694d7988ad00518c8d55c36d907af11fdbaaec42beab29b83bfce9c8d02391094cef2016563443bd40a6e7797f1fb8a5038f8672598be5d0b243
-
Filesize
236KB
MD588b796b900e03e2b0beaad0ccccee384
SHA1be4840f0fa330440363f0a1a3c52b4f70a2eb253
SHA256443c53a146dda33a10df2a50a07403f5b9c15a592cd9bec3c86ce8b5ec3c84d9
SHA512e877319babf9694d7988ad00518c8d55c36d907af11fdbaaec42beab29b83bfce9c8d02391094cef2016563443bd40a6e7797f1fb8a5038f8672598be5d0b243
-
Filesize
236KB
MD588b796b900e03e2b0beaad0ccccee384
SHA1be4840f0fa330440363f0a1a3c52b4f70a2eb253
SHA256443c53a146dda33a10df2a50a07403f5b9c15a592cd9bec3c86ce8b5ec3c84d9
SHA512e877319babf9694d7988ad00518c8d55c36d907af11fdbaaec42beab29b83bfce9c8d02391094cef2016563443bd40a6e7797f1fb8a5038f8672598be5d0b243
-
Filesize
236KB
MD588b796b900e03e2b0beaad0ccccee384
SHA1be4840f0fa330440363f0a1a3c52b4f70a2eb253
SHA256443c53a146dda33a10df2a50a07403f5b9c15a592cd9bec3c86ce8b5ec3c84d9
SHA512e877319babf9694d7988ad00518c8d55c36d907af11fdbaaec42beab29b83bfce9c8d02391094cef2016563443bd40a6e7797f1fb8a5038f8672598be5d0b243
-
Filesize
236KB
MD588b796b900e03e2b0beaad0ccccee384
SHA1be4840f0fa330440363f0a1a3c52b4f70a2eb253
SHA256443c53a146dda33a10df2a50a07403f5b9c15a592cd9bec3c86ce8b5ec3c84d9
SHA512e877319babf9694d7988ad00518c8d55c36d907af11fdbaaec42beab29b83bfce9c8d02391094cef2016563443bd40a6e7797f1fb8a5038f8672598be5d0b243
-
Filesize
236KB
MD588b796b900e03e2b0beaad0ccccee384
SHA1be4840f0fa330440363f0a1a3c52b4f70a2eb253
SHA256443c53a146dda33a10df2a50a07403f5b9c15a592cd9bec3c86ce8b5ec3c84d9
SHA512e877319babf9694d7988ad00518c8d55c36d907af11fdbaaec42beab29b83bfce9c8d02391094cef2016563443bd40a6e7797f1fb8a5038f8672598be5d0b243
-
Filesize
1.4MB
MD5d6b05020d4a0ec2a3a8b687099e335df
SHA1df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA2569824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
SHA51278fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
-
Filesize
1.4MB
MD5d6b05020d4a0ec2a3a8b687099e335df
SHA1df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA2569824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
SHA51278fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
-
Filesize
1.4MB
MD5d6b05020d4a0ec2a3a8b687099e335df
SHA1df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA2569824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
SHA51278fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
-
Filesize
236KB
MD5b0bc3b28320d5c348b968812200a7c74
SHA1dc43c7a7dc8dd65edb8e69b7ceea6bc2571f0569
SHA256069e2385e028d6d952bb8a71aa0d7d8a5815d52c500f29e105c217f6126a0e72
SHA512fc901182734d45884dfe886a844b110505ec38a85d6147cd0b307f51268b07e4c2bc9817168630cd8d68d3d23c71c5a40a7e5b8eb8ce706e877c7156ee61b69f
-
Filesize
236KB
MD5099301382e3d8771459b41451ba92fe7
SHA15c811e501d86259b36a72f624c37b18e1ac52636
SHA2561138eb7285cfe7e66dd53fa603785c5956e7eb7878e5fdadb6b039a5b8179202
SHA5121db022398aee327e8a0738c451fcfc72250a722667516b94c492014a7e8ffbb53d8b73eed1e0249c52916feb6ce9ccc06d83879139ebba8b7c5f7f1a270f4c4d
-
Filesize
236KB
MD502e74558a1fc10e923bba93279df29b8
SHA1d95bb227a40f571a8a3d7e591b669188672eec3f
SHA256cadd03cdc17c6442b14969adecff9a1d22bf1520b277219c73ef6c39a9d8fcf3
SHA512c2f22acc9e3088baaa51ad6523ee072c4b143cbc1d942631c7ee6c316b76f3b08ef20b6978766b39b142e928b47ef1222cfae0da7ceb169c935d90a461e24a22
-
Filesize
236KB
MD54e095eed3e6ab08bdc1df99110685316
SHA1988516eb3fe161cff0a08080ed5ee07846b7c0f8
SHA25648a692d4ad82956226c6796ece25eb084547b91923394f706bec9b5889b6faaa
SHA512391f309a2e6e79e0ac4a12547d4c8b5a7cc222cba9c1b027bd2e304bf3b4667126d9d7f6ac857946d3451d81f125d0cfc9edf1f50803f72348f53f29c5af4759
-
Filesize
236KB
MD5099301382e3d8771459b41451ba92fe7
SHA15c811e501d86259b36a72f624c37b18e1ac52636
SHA2561138eb7285cfe7e66dd53fa603785c5956e7eb7878e5fdadb6b039a5b8179202
SHA5121db022398aee327e8a0738c451fcfc72250a722667516b94c492014a7e8ffbb53d8b73eed1e0249c52916feb6ce9ccc06d83879139ebba8b7c5f7f1a270f4c4d
-
Filesize
236KB
MD5099301382e3d8771459b41451ba92fe7
SHA15c811e501d86259b36a72f624c37b18e1ac52636
SHA2561138eb7285cfe7e66dd53fa603785c5956e7eb7878e5fdadb6b039a5b8179202
SHA5121db022398aee327e8a0738c451fcfc72250a722667516b94c492014a7e8ffbb53d8b73eed1e0249c52916feb6ce9ccc06d83879139ebba8b7c5f7f1a270f4c4d
-
Filesize
236KB
MD5099301382e3d8771459b41451ba92fe7
SHA15c811e501d86259b36a72f624c37b18e1ac52636
SHA2561138eb7285cfe7e66dd53fa603785c5956e7eb7878e5fdadb6b039a5b8179202
SHA5121db022398aee327e8a0738c451fcfc72250a722667516b94c492014a7e8ffbb53d8b73eed1e0249c52916feb6ce9ccc06d83879139ebba8b7c5f7f1a270f4c4d
-
Filesize
236KB
MD56dde4191d841edf0637b76c76f16ac3c
SHA1245a87ff8bf1edcb7e77c52362d182e4cea580b0
SHA256324819e403557616c03aba4bec832d2f801fc346777053f2234e494a0286b23f
SHA512dbed9231e006d4f1b3c355bafb8d573c66be5d9511c5674b644484f3163c1414161f3fa38d39b682edf8dcf2518c8fdca85e40a767fddd0adaafa4c4fa7121a8
-
Filesize
236KB
MD515820a6dd7dd22232491abfbf5907eca
SHA1a82b1f47af7aa54e18ae81bb0ae67bddd1396f09
SHA25642618d21970ca5b9208af071a65ed2aea46cf4e8976f2d04a0dade43f10ac75a
SHA512843c926546ab19479c7a4ae53e7639fe8c76ba1d17f1eed9fbc7f0cf8881f3de72a7a3f07ff36ebece52d6a2de707d99dda35b36ad1b3843066c5b94cd971e1a
-
Filesize
236KB
MD58c49cac5de9f2c7e55df519dc6c499b5
SHA11b555511d069648949222daffd7c7b0e4b0d1c67
SHA256a5a271124e896360b717498ceb623725a709b00062403009d9fa9693fb7d0cd0
SHA512852be3c7af56512690b7ff7eceaec2ed0886e1a17d98e904f6efae4973c551438738db7f765bca21aeee4709b42071417d8cf82e9c62c22a9f09169118fcebc0
-
Filesize
236KB
MD58f0ab6d42c44e8e1c56253937cd89913
SHA1d04dc67e2fde7bf500ed32e434ba49f332ea131b
SHA256286b7899c1412af96059f4ececf2dfe7e98fdccb9aea76ebd3a4879cefe48a3d
SHA512c04eb5d8e1a9ca513728a932a3407ef156a88f3c33e251c3209a949fececb03ed29a21f6aec5a10fddef0245da63999ae26d6f33662f43762969d9da4b819a96
-
Filesize
236KB
MD5a00490cc2e5fbb6db07620d5f8297a9f
SHA1a4abf8e9619d398d3bfa53643bd1d3aaaae3a40b
SHA25639f9e54e693472bfc678e8f0efb58a384e2c602d390b6ded58738c2cc2a98237
SHA5127ea0052138f6bad955c8369e6d2d019f84ff0f0465f199fcdf9010fc8cdb61b23e5158fb3f69692641e8ca2147bdd610386c8d97734a74d279875683c7c23a73
-
Filesize
236KB
MD5c0c37fea0ee8b5ab677976b6b3d7cce8
SHA1bbbcca854f906398ed5e7e7ceaca659ca0474a7f
SHA256cbad9bc4089ee1db8a5c349205cfe0177b60e8b4fa2039cdcf9c92d3159cbebd
SHA5127edd31602877bc06f474e4fc388ea530902893018baec09ae7e64e276338d7dead6d617dba93230ab8a69e56c70ecec0e7140a71a721671a30ab2d816e36bfc3
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
236KB
MD5884dc7bc416a36cf6eb90ecdf6291bb2
SHA1e350cfa73b3ec1aa79aa75d6416322ce34c78f35
SHA256c25938faeb23db391e1eaf2072dd56463421072c26e9477051d22ea98e58de74
SHA5122c5b609c1cf1ca6c44e623dba084cf661430cc5857c374359fe9ff2b5616894b643d460e1a505af865f91ab58524bf533251934eb57e04cc4cb91ad432ab79cd
-
Filesize
236KB
MD5884dc7bc416a36cf6eb90ecdf6291bb2
SHA1e350cfa73b3ec1aa79aa75d6416322ce34c78f35
SHA256c25938faeb23db391e1eaf2072dd56463421072c26e9477051d22ea98e58de74
SHA5122c5b609c1cf1ca6c44e623dba084cf661430cc5857c374359fe9ff2b5616894b643d460e1a505af865f91ab58524bf533251934eb57e04cc4cb91ad432ab79cd
-
Filesize
236KB
MD5884dc7bc416a36cf6eb90ecdf6291bb2
SHA1e350cfa73b3ec1aa79aa75d6416322ce34c78f35
SHA256c25938faeb23db391e1eaf2072dd56463421072c26e9477051d22ea98e58de74
SHA5122c5b609c1cf1ca6c44e623dba084cf661430cc5857c374359fe9ff2b5616894b643d460e1a505af865f91ab58524bf533251934eb57e04cc4cb91ad432ab79cd
-
Filesize
236KB
MD58c49cac5de9f2c7e55df519dc6c499b5
SHA11b555511d069648949222daffd7c7b0e4b0d1c67
SHA256a5a271124e896360b717498ceb623725a709b00062403009d9fa9693fb7d0cd0
SHA512852be3c7af56512690b7ff7eceaec2ed0886e1a17d98e904f6efae4973c551438738db7f765bca21aeee4709b42071417d8cf82e9c62c22a9f09169118fcebc0
-
Filesize
236KB
MD58c49cac5de9f2c7e55df519dc6c499b5
SHA11b555511d069648949222daffd7c7b0e4b0d1c67
SHA256a5a271124e896360b717498ceb623725a709b00062403009d9fa9693fb7d0cd0
SHA512852be3c7af56512690b7ff7eceaec2ed0886e1a17d98e904f6efae4973c551438738db7f765bca21aeee4709b42071417d8cf82e9c62c22a9f09169118fcebc0
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
236KB
MD588b796b900e03e2b0beaad0ccccee384
SHA1be4840f0fa330440363f0a1a3c52b4f70a2eb253
SHA256443c53a146dda33a10df2a50a07403f5b9c15a592cd9bec3c86ce8b5ec3c84d9
SHA512e877319babf9694d7988ad00518c8d55c36d907af11fdbaaec42beab29b83bfce9c8d02391094cef2016563443bd40a6e7797f1fb8a5038f8672598be5d0b243
-
Filesize
236KB
MD588b796b900e03e2b0beaad0ccccee384
SHA1be4840f0fa330440363f0a1a3c52b4f70a2eb253
SHA256443c53a146dda33a10df2a50a07403f5b9c15a592cd9bec3c86ce8b5ec3c84d9
SHA512e877319babf9694d7988ad00518c8d55c36d907af11fdbaaec42beab29b83bfce9c8d02391094cef2016563443bd40a6e7797f1fb8a5038f8672598be5d0b243
-
Filesize
236KB
MD588b796b900e03e2b0beaad0ccccee384
SHA1be4840f0fa330440363f0a1a3c52b4f70a2eb253
SHA256443c53a146dda33a10df2a50a07403f5b9c15a592cd9bec3c86ce8b5ec3c84d9
SHA512e877319babf9694d7988ad00518c8d55c36d907af11fdbaaec42beab29b83bfce9c8d02391094cef2016563443bd40a6e7797f1fb8a5038f8672598be5d0b243
-
Filesize
236KB
MD588b796b900e03e2b0beaad0ccccee384
SHA1be4840f0fa330440363f0a1a3c52b4f70a2eb253
SHA256443c53a146dda33a10df2a50a07403f5b9c15a592cd9bec3c86ce8b5ec3c84d9
SHA512e877319babf9694d7988ad00518c8d55c36d907af11fdbaaec42beab29b83bfce9c8d02391094cef2016563443bd40a6e7797f1fb8a5038f8672598be5d0b243
-
Filesize
236KB
MD588b796b900e03e2b0beaad0ccccee384
SHA1be4840f0fa330440363f0a1a3c52b4f70a2eb253
SHA256443c53a146dda33a10df2a50a07403f5b9c15a592cd9bec3c86ce8b5ec3c84d9
SHA512e877319babf9694d7988ad00518c8d55c36d907af11fdbaaec42beab29b83bfce9c8d02391094cef2016563443bd40a6e7797f1fb8a5038f8672598be5d0b243
-
Filesize
236KB
MD5099301382e3d8771459b41451ba92fe7
SHA15c811e501d86259b36a72f624c37b18e1ac52636
SHA2561138eb7285cfe7e66dd53fa603785c5956e7eb7878e5fdadb6b039a5b8179202
SHA5121db022398aee327e8a0738c451fcfc72250a722667516b94c492014a7e8ffbb53d8b73eed1e0249c52916feb6ce9ccc06d83879139ebba8b7c5f7f1a270f4c4d
-
Filesize
236KB
MD5099301382e3d8771459b41451ba92fe7
SHA15c811e501d86259b36a72f624c37b18e1ac52636
SHA2561138eb7285cfe7e66dd53fa603785c5956e7eb7878e5fdadb6b039a5b8179202
SHA5121db022398aee327e8a0738c451fcfc72250a722667516b94c492014a7e8ffbb53d8b73eed1e0249c52916feb6ce9ccc06d83879139ebba8b7c5f7f1a270f4c4d
