ef7d5edea1d6cd87ea8cfcf720aab0261bd20c0e06de4c093317dd1fd73bfac8

Analysis

max time kernel
175s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef7d5edea1d6cd87ea8cfcf720aab0261bd20c0e06de4c093317dd1fd73bfac8.exe
Size

1.2MB
MD5

41af5d97063e79571d2657ba3187c266
SHA1

54b0f7f811b543f336fc60c6bac9ac8b9402c67f
SHA256

ef7d5edea1d6cd87ea8cfcf720aab0261bd20c0e06de4c093317dd1fd73bfac8
SHA512

99d466ff3262ef412d61f426ea2bff455b6e586b76d81fc77cabde9c8b8fa7188bf6699f3339ee6b1714bd85ad8ddb4ae816135b9b81b60894a90064716471ff
SSDEEP

24576:KAFJnZX4kxKlUJKztq+qGh0FyCBQW6HYTa6ac+VHnX23Om5ewVR4eotaE:HFJnjPKzttIIRHca6aBwdfVRMME

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4884	FULLHA~1.EXE
1248	bootc0g.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	FULLHA~1.EXE

Loads dropped DLL 2 IoCs

pid	Process
1248	bootc0g.exe
1248	bootc0g.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ef7d5edea1d6cd87ea8cfcf720aab0261bd20c0e06de4c093317dd1fd73bfac8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ef7d5edea1d6cd87ea8cfcf720aab0261bd20c0e06de4c093317dd1fd73bfac8.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	bootc0g.exe
File opened (read-only)	\??\N:	bootc0g.exe
File opened (read-only)	\??\S:	bootc0g.exe
File opened (read-only)	\??\U:	bootc0g.exe
File opened (read-only)	\??\V:	bootc0g.exe
File opened (read-only)	\??\Z:	bootc0g.exe
File opened (read-only)	\??\B:	bootc0g.exe
File opened (read-only)	\??\E:	bootc0g.exe
File opened (read-only)	\??\H:	bootc0g.exe
File opened (read-only)	\??\O:	bootc0g.exe
File opened (read-only)	\??\P:	bootc0g.exe
File opened (read-only)	\??\Q:	bootc0g.exe
File opened (read-only)	\??\X:	bootc0g.exe
File opened (read-only)	\??\A:	bootc0g.exe
File opened (read-only)	\??\K:	bootc0g.exe
File opened (read-only)	\??\W:	bootc0g.exe
File opened (read-only)	\??\Y:	bootc0g.exe
File opened (read-only)	\??\F:	bootc0g.exe
File opened (read-only)	\??\I:	bootc0g.exe
File opened (read-only)	\??\J:	bootc0g.exe
File opened (read-only)	\??\L:	bootc0g.exe
File opened (read-only)	\??\M:	bootc0g.exe
File opened (read-only)	\??\R:	bootc0g.exe
File opened (read-only)	\??\T:	bootc0g.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\GIFviewer.ocx	FULLHA~1.EXE
File opened for modification	C:\windows\SysWOW64\GIFviewer.ocx	FULLHA~1.EXE
File created	C:\windows\SysWOW64\ds0und3d.dll	FULLHA~1.EXE
File opened for modification	C:\windows\SysWOW64\ds0und3d.dll	FULLHA~1.EXE
File created	C:\windows\SysWOW64\bootc0g.exe	FULLHA~1.EXE
File opened for modification	C:\windows\SysWOW64\bootc0g.exe	FULLHA~1.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\MiscStatus	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\MiscStatus\ = "0"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0\FLAGS	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\TypeLib\Version = "1.0"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\TypeLib\ = "{3383D1F1-029B-43B1-8733-289322EA85FA}"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\TypeLib\ = "{3383D1F1-029B-43B1-8733-289322EA85FA}"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\TypeLib\ = "{3383D1F1-029B-43B1-8733-289322EA85FA}"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0\ = "WelchGIFviewer"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\VERSION	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\VERSION\ = "1.0"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\TypeLib\ = "{3383D1F1-029B-43B1-8733-289322EA85FA}"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\ProgID\ = "WelchGIFviewer.ucAniGIF"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0\0	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\TypeLib\Version = "1.0"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08D24088-19F0-490A-93C8-84B68381D155}	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\Control\	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\MiscStatus\1\ = "147857"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0\FLAGS\ = "2"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0\HELPDIR	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\TypeLib\Version = "1.0"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ = "__ucAniGIF"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\ToolboxBitmap32\ = "C:\\windows\\SysWow64\\GIFviewer.ocx, 30000"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WelchGIFviewer.ucAniGIF	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WelchGIFviewer.ucAniGIF\ = "WelchGIFviewer.ucAniGIF"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WelchGIFviewer.ucAniGIF\Clsid\ = "{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ = "ucAniGIF"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\ProxyStubClsid32	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WelchGIFviewer.ucAniGIF\Clsid	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\Implemented Categories	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0\0\win32	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\ = "WelchGIFviewer.ucAniGIF"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\ProgID	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ProxyStubClsid	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0\0\win32\ = "C:\\windows\\SysWow64\\GIFviewer.ocx"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0\HELPDIR\ = "C:\\windows\\System32"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\ProxyStubClsid32	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ProxyStubClsid32	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\TypeLib	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\TypeLib\Version = "1.0"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ProxyStubClsid32	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\TypeLib\ = "{3383D1F1-029B-43B1-8733-289322EA85FA}"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\MiscStatus\1	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\ = "ucAniGIF"	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\ = "_ucAniGIF"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\TypeLib	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\TypeLib	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\InprocServer32	bootc0g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\InprocServer32\ = "C:\\windows\\SysWow64\\GIFviewer.ocx"	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\TypeLib	bootc0g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0	bootc0g.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
3948	msedge.exe
3948	msedge.exe
1672	msedge.exe
1672	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1248	bootc0g.exe
Token: SeCreatePagefilePrivilege	1248	bootc0g.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1248	bootc0g.exe
1248	bootc0g.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 4884	1824	ef7d5edea1d6cd87ea8cfcf720aab0261bd20c0e06de4c093317dd1fd73bfac8.exe	82
PID 1824 wrote to memory of 4884	1824	ef7d5edea1d6cd87ea8cfcf720aab0261bd20c0e06de4c093317dd1fd73bfac8.exe	82
PID 1824 wrote to memory of 4884	1824	ef7d5edea1d6cd87ea8cfcf720aab0261bd20c0e06de4c093317dd1fd73bfac8.exe	82
PID 4884 wrote to memory of 1248	4884	FULLHA~1.EXE	83
PID 4884 wrote to memory of 1248	4884	FULLHA~1.EXE	83
PID 4884 wrote to memory of 1248	4884	FULLHA~1.EXE	83
PID 1248 wrote to memory of 1672	1248	bootc0g.exe	84
PID 1248 wrote to memory of 1672	1248	bootc0g.exe	84
PID 1672 wrote to memory of 4136	1672	msedge.exe	85
PID 1672 wrote to memory of 4136	1672	msedge.exe	85
PID 1248 wrote to memory of 3076	1248	bootc0g.exe	86
PID 1248 wrote to memory of 3076	1248	bootc0g.exe	86
PID 3076 wrote to memory of 60	3076	msedge.exe	87
PID 3076 wrote to memory of 60	3076	msedge.exe	87
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 3464	1672	msedge.exe	90
PID 1672 wrote to memory of 728	1672	msedge.exe	91
PID 1672 wrote to memory of 728	1672	msedge.exe	91
PID 3076 wrote to memory of 3320	3076	msedge.exe	93
PID 3076 wrote to memory of 3320	3076	msedge.exe	93
PID 3076 wrote to memory of 3320	3076	msedge.exe	93
PID 3076 wrote to memory of 3320	3076	msedge.exe	93
PID 3076 wrote to memory of 3320	3076	msedge.exe	93
PID 3076 wrote to memory of 3320	3076	msedge.exe	93
PID 3076 wrote to memory of 3320	3076	msedge.exe	93
PID 3076 wrote to memory of 3320	3076	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\ef7d5edea1d6cd87ea8cfcf720aab0261bd20c0e06de4c093317dd1fd73bfac8.exe
"C:\Users\Admin\AppData\Local\Temp\ef7d5edea1d6cd87ea8cfcf720aab0261bd20c0e06de4c093317dd1fd73bfac8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FULLHA~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FULLHA~1.EXE
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\windows\SysWOW64\bootc0g.exe
    "C:\windows\system32\bootc0g.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://adf.ly/ynSD
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd0c0c46f8,0x7ffd0c0c4708,0x7ffd0c0c4718
        5⤵
        
        PID:4136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
        5⤵
        
        PID:3464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
        5⤵
        
        PID:436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
        5⤵
        
        PID:684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
        5⤵
        
        PID:3484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
        5⤵
        
        PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5476 /prefetch:8
        5⤵
        
        PID:508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
        5⤵
        
        PID:3420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
        5⤵
        
        PID:3500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5840 /prefetch:8
        5⤵
        
        PID:2684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
        5⤵
        
        PID:4788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
        5⤵
        
        PID:4780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3753961918683023910,13996483065609056748,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3300 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://toyibg.blogspot.com/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd4,0xfc,0x100,0xf8,0x104,0x7ffd0c0c46f8,0x7ffd0c0c4708,0x7ffd0c0c4718
        5⤵
        
        PID:60
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2073228098177044242,7626324787511306847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2073228098177044242,7626324787511306847,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        5⤵
        
        PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
471B

MD5
80a0b5026385c3e3df582df9fc8fec9b

SHA1
fb2dbcb443777c8f3a649b3662e3a1e518f63616

SHA256
7ba78f8c7a24dbe5e7e4b1be898c14e872a3bef211f4700da3671818d1670b50

SHA512
b4945af394a04f4b0d9d9c65b39da704605438fa7fe6728b2a2e1f9f7a5712e358858512b2be6787f373bf80f9991ff2849c8d3a03ac28956efe7e7147df0a4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
446B

MD5
0d3442d8928118659bdde1a0e2711d1a

SHA1
c84deb2cd83fbd3407069b44edabe7258d6aea2f

SHA256
87339ea214ba585e6316be63097eed5d620623174369a407c9d67c5a87a54e64

SHA512
fac5a3b8183ca9ef4e6a191edefd2216461e22a176f227f73b93357e21ca11d612e427902b842dfab6aca811063e3083e78e665fb7deba011e805c60d74bb029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
727230d7b0f8df1633bc043529f5c15d

SHA1
5b24d959d4c5dcf8125125dbee37225d6160af18

SHA256
54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998

SHA512
35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
727230d7b0f8df1633bc043529f5c15d

SHA1
5b24d959d4c5dcf8125125dbee37225d6160af18

SHA256
54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998

SHA512
35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
727230d7b0f8df1633bc043529f5c15d

SHA1
5b24d959d4c5dcf8125125dbee37225d6160af18

SHA256
54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998

SHA512
35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
d7ae40791b8d25683476cf4f1a0e5366

SHA1
01cf8dbedee759fd449f43e7f2cfc2d6ffbecba2

SHA256
4aaf0d02fa8aa9d8176b1e9433887541af5ed8cbd405bcae1d12c3cbb6149e6e

SHA512
5c4f5e0526304c25efee66ef96ac1f20f20718d94764de107846daf6e11f529902ed4dfcf605b2df8e1395a129bc6efaa16e5fb2adcb0de9458ba88a5a4f428a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FULLHA~1.EXE

Filesize
1.3MB

MD5
2e95b3dfacf8450e01da3adbf670cd17

SHA1
6f4a04756206a031df6128d409904a58510c5b8c

SHA256
9b5f79dbe2f0babda391e6a49b6660ef6255c25801b57d9996f00d49047f6fac

SHA512
39fc703c8d776b59d582c44aeb6209c48df860b91fe9c5a9ad0016f71f45f4fbcf4cfe8860a0d3be527b6a8b1ff425eb1cb300f24fea189f681d2ee1b1f6e2a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FULLHA~1.EXE

Filesize
1.3MB

MD5
2e95b3dfacf8450e01da3adbf670cd17

SHA1
6f4a04756206a031df6128d409904a58510c5b8c

SHA256
9b5f79dbe2f0babda391e6a49b6660ef6255c25801b57d9996f00d49047f6fac

SHA512
39fc703c8d776b59d582c44aeb6209c48df860b91fe9c5a9ad0016f71f45f4fbcf4cfe8860a0d3be527b6a8b1ff425eb1cb300f24fea189f681d2ee1b1f6e2a2

Download Submit
C:\Windows\SysWOW64\GIFviewer.ocx

Filesize
100KB

MD5
73404435b36b8cb9ea68be6d4249488e

SHA1
ecd6f0e28c4f4ac6c1943a7647f42a5d91c14f02

SHA256
2123cadad9f7da81601c5e09105a569fedda561b4b12e87f0c0f6b4afa286e5c

SHA512
e260099024bdc4711ef068455e350cb400042f5fd5066b07b024e49b8a13b6c058347f2e4e68ff73704358b51db851e4e06c28cb2f3cd36b64d9023c748dcad7

Download Submit
C:\Windows\SysWOW64\GIFviewer.ocx

Filesize
100KB

MD5
73404435b36b8cb9ea68be6d4249488e

SHA1
ecd6f0e28c4f4ac6c1943a7647f42a5d91c14f02

SHA256
2123cadad9f7da81601c5e09105a569fedda561b4b12e87f0c0f6b4afa286e5c

SHA512
e260099024bdc4711ef068455e350cb400042f5fd5066b07b024e49b8a13b6c058347f2e4e68ff73704358b51db851e4e06c28cb2f3cd36b64d9023c748dcad7

Download Submit
C:\Windows\SysWOW64\bootc0g.exe

Filesize
359KB

MD5
f782d7f76ad1c7f7c90dde21a6ee7668

SHA1
bbcbfc19575a1678a7a806a308c36b783e9b5bbd

SHA256
d9979dbb45f425549b8e7d2397de591db3c21d7a09c25c0eaf4df9496c19386d

SHA512
b75a9196993095e43757b0315de6403cd868a4eff91b7694b579ecd84ad943ab79f0f63f59313331afbb383ba74813cf62a7d40c5b052945801ed64c93b1ec4b

Download Submit
C:\windows\SysWOW64\GIFviewer.ocx

Filesize
100KB

MD5
73404435b36b8cb9ea68be6d4249488e

SHA1
ecd6f0e28c4f4ac6c1943a7647f42a5d91c14f02

SHA256
2123cadad9f7da81601c5e09105a569fedda561b4b12e87f0c0f6b4afa286e5c

SHA512
e260099024bdc4711ef068455e350cb400042f5fd5066b07b024e49b8a13b6c058347f2e4e68ff73704358b51db851e4e06c28cb2f3cd36b64d9023c748dcad7

Download Submit
C:\windows\SysWOW64\bootc0g.exe

Filesize
359KB

MD5
f782d7f76ad1c7f7c90dde21a6ee7668

SHA1
bbcbfc19575a1678a7a806a308c36b783e9b5bbd

SHA256
d9979dbb45f425549b8e7d2397de591db3c21d7a09c25c0eaf4df9496c19386d

SHA512
b75a9196993095e43757b0315de6403cd868a4eff91b7694b579ecd84ad943ab79f0f63f59313331afbb383ba74813cf62a7d40c5b052945801ed64c93b1ec4b

Download Submit