Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 23:50
Static task
static1
Behavioral task
behavioral1
Sample
bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe
Resource
win10v2004-20220812-en
General
-
Target
bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe
-
Size
684KB
-
MD5
a2956dfca9be381f1184f9ce81845ab0
-
SHA1
a92d3c8c18b08f1fa2be87d850799c6c271bb8ec
-
SHA256
bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd
-
SHA512
4fd4c221910cb6d1f577fa427e479ba677c77c592f6b0cca6cb94081357cc56c185df5d233614a1bd867de60520b3320c8b5e0fce7297504e2cda5985bc07789
-
SSDEEP
12288:UpgvmzFHi0mo5aH0qMzd5807F4PJQPDHvd:UpgvOHi0mGaH0qSdPFq4V
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" cbgpt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cbgpt.exe -
Adds policy Run key to start application 2 TTPs 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zdnbkriraf = "crmlfxztndivsfhzwyqfa.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\abitzdr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crmlfxztndivsfhzwyqfa.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zdnbkriraf = "nbvtmdexqfjvrdevrsjx.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zdnbkriraf = "zjztivshwhhphpmz.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\abitzdr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crmlfxztndivsfhzwyqfa.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zdnbkriraf = "angdvlldvjmxsddtooe.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zdnbkriraf = "pbtpgvulcprbvfetnm.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\abitzdr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zjztivshwhhphpmz.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\abitzdr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zjztivshwhhphpmz.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zdnbkriraf = "angdvlldvjmxsddtooe.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\abitzdr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gridthfvlxyhajhvo.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zdnbkriraf = "crmlfxztndivsfhzwyqfa.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zdnbkriraf = "pbtpgvulcprbvfetnm.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zdnbkriraf = "crmlfxztndivsfhzwyqfa.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zdnbkriraf = "gridthfvlxyhajhvo.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\abitzdr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pbtpgvulcprbvfetnm.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\abitzdr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pbtpgvulcprbvfetnm.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\abitzdr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nbvtmdexqfjvrdevrsjx.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\abitzdr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gridthfvlxyhajhvo.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zdnbkriraf = "nbvtmdexqfjvrdevrsjx.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\abitzdr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\angdvlldvjmxsddtooe.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\abitzdr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\angdvlldvjmxsddtooe.exe" cbgpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\abitzdr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\angdvlldvjmxsddtooe.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cbgpt.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cbgpt.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cbgpt.exe -
Executes dropped EXE 2 IoCs
pid Process 1480 cbgpt.exe 2324 cbgpt.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pbtpgvulcprbvfetnm.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uzkzjrjtdje = "gridthfvlxyhajhvo.exe" cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pbtpgvulcprbvfetnm.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qxkbnxrdpxuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gridthfvlxyhajhvo.exe ." bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uzkzjrjtdje = "angdvlldvjmxsddtooe.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "gridthfvlxyhajhvo.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rznfsdylyhflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zjztivshwhhphpmz.exe" cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uzkzjrjtdje = "zjztivshwhhphpmz.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qxkbnxrdpxuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zjztivshwhhphpmz.exe ." cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "pbtpgvulcprbvfetnm.exe ." bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rxjzktmxiplp = "nbvtmdexqfjvrdevrsjx.exe ." cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "pbtpgvulcprbvfetnm.exe" cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rxjzktmxiplp = "pbtpgvulcprbvfetnm.exe ." cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nbvtmdexqfjvrdevrsjx.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rznfsdylyhflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\angdvlldvjmxsddtooe.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rznfsdylyhflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pbtpgvulcprbvfetnm.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "angdvlldvjmxsddtooe.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "pbtpgvulcprbvfetnm.exe ." cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rznfsdylyhflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crmlfxztndivsfhzwyqfa.exe" cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rxjzktmxiplp = "gridthfvlxyhajhvo.exe ." cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uzkzjrjtdje = "zjztivshwhhphpmz.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "zjztivshwhhphpmz.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pbtpgvulcprbvfetnm.exe ." cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zjztivshwhhphpmz.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "zjztivshwhhphpmz.exe" cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zjztivshwhhphpmz.exe ." cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "gridthfvlxyhajhvo.exe" cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rxjzktmxiplp = "pbtpgvulcprbvfetnm.exe ." cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "angdvlldvjmxsddtooe.exe ." bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nbvtmdexqfjvrdevrsjx.exe ." cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rxjzktmxiplp = "crmlfxztndivsfhzwyqfa.exe ." cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uzkzjrjtdje = "pbtpgvulcprbvfetnm.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "pbtpgvulcprbvfetnm.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "nbvtmdexqfjvrdevrsjx.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "gridthfvlxyhajhvo.exe ." cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rxjzktmxiplp = "gridthfvlxyhajhvo.exe ." bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "nbvtmdexqfjvrdevrsjx.exe ." cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rznfsdylyhflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gridthfvlxyhajhvo.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "nbvtmdexqfjvrdevrsjx.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "angdvlldvjmxsddtooe.exe ." cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "crmlfxztndivsfhzwyqfa.exe ." cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qxkbnxrdpxuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crmlfxztndivsfhzwyqfa.exe ." cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gridthfvlxyhajhvo.exe" cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rxjzktmxiplp = "angdvlldvjmxsddtooe.exe ." cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uzkzjrjtdje = "angdvlldvjmxsddtooe.exe" cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zjztivshwhhphpmz.exe ." cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crmlfxztndivsfhzwyqfa.exe ." cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uzkzjrjtdje = "nbvtmdexqfjvrdevrsjx.exe" cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rxjzktmxiplp = "pbtpgvulcprbvfetnm.exe ." bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce cbgpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uzkzjrjtdje = "crmlfxztndivsfhzwyqfa.exe" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qxkbnxrdpxuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nbvtmdexqfjvrdevrsjx.exe ." bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "crmlfxztndivsfhzwyqfa.exe" cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uzkzjrjtdje = "pbtpgvulcprbvfetnm.exe" cbgpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gjsfntjrz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crmlfxztndivsfhzwyqfa.exe ." bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rznfsdylyhflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crmlfxztndivsfhzwyqfa.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rznfsdylyhflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zjztivshwhhphpmz.exe" cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uzkzjrjtdje = "nbvtmdexqfjvrdevrsjx.exe" cbgpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "nbvtmdexqfjvrdevrsjx.exe" cbgpt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\przlsxmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zjztivshwhhphpmz.exe" cbgpt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbgpt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbgpt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cbgpt.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 36 www.showmyipaddress.com 54 whatismyip.everdot.org 61 whatismyipaddress.com -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\mjmtvvfhjhupupzzeoolovxxh.ljw cbgpt.exe File opened for modification C:\Windows\SysWOW64\rznfsdylyhflbhcndyjrfxkvqdqzxdtzufvq.jxp cbgpt.exe File created C:\Windows\SysWOW64\rznfsdylyhflbhcndyjrfxkvqdqzxdtzufvq.jxp cbgpt.exe File opened for modification C:\Windows\SysWOW64\mjmtvvfhjhupupzzeoolovxxh.ljw cbgpt.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\mjmtvvfhjhupupzzeoolovxxh.ljw cbgpt.exe File created C:\Program Files (x86)\mjmtvvfhjhupupzzeoolovxxh.ljw cbgpt.exe File opened for modification C:\Program Files (x86)\rznfsdylyhflbhcndyjrfxkvqdqzxdtzufvq.jxp cbgpt.exe File created C:\Program Files (x86)\rznfsdylyhflbhcndyjrfxkvqdqzxdtzufvq.jxp cbgpt.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\mjmtvvfhjhupupzzeoolovxxh.ljw cbgpt.exe File created C:\Windows\mjmtvvfhjhupupzzeoolovxxh.ljw cbgpt.exe File opened for modification C:\Windows\rznfsdylyhflbhcndyjrfxkvqdqzxdtzufvq.jxp cbgpt.exe File created C:\Windows\rznfsdylyhflbhcndyjrfxkvqdqzxdtzufvq.jxp cbgpt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings cbgpt.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1480 cbgpt.exe 1480 cbgpt.exe 1480 cbgpt.exe 1480 cbgpt.exe 1480 cbgpt.exe 1480 cbgpt.exe 1480 cbgpt.exe 1480 cbgpt.exe 1480 cbgpt.exe 1480 cbgpt.exe 1480 cbgpt.exe 1480 cbgpt.exe 1480 cbgpt.exe 1480 cbgpt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1480 cbgpt.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3320 wrote to memory of 1480 3320 bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe 82 PID 3320 wrote to memory of 1480 3320 bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe 82 PID 3320 wrote to memory of 1480 3320 bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe 82 PID 3320 wrote to memory of 2324 3320 bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe 83 PID 3320 wrote to memory of 2324 3320 bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe 83 PID 3320 wrote to memory of 2324 3320 bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe 83 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cbgpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" cbgpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cbgpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cbgpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" cbgpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" cbgpt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe"C:\Users\Admin\AppData\Local\Temp\bf7b28989ddb52cfbbc4bc58acdd33121fe8d95f081185f825ca05085789a5bd.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\cbgpt.exe"C:\Users\Admin\AppData\Local\Temp\cbgpt.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1480
-
-
C:\Users\Admin\AppData\Local\Temp\cbgpt.exe"C:\Users\Admin\AppData\Local\Temp\cbgpt.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- System policy modification
PID:2324
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3828
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD538b986b1146fc342647e90847e6b6cef
SHA1af973b604ea10d87e3b68fee1e05536b699af79d
SHA256538cf37226e5871b4e7d96f3d639bc5708a3cf2dcd52616029387f40684fc1dd
SHA512a65b608c767244affe2f9c436d270998c56098b99522bc564c85cfd2adf4cb79d6172212ad5877859637bf265ada75bea479b961ae07769cab3b13329ca688d4
-
Filesize
1.2MB
MD538b986b1146fc342647e90847e6b6cef
SHA1af973b604ea10d87e3b68fee1e05536b699af79d
SHA256538cf37226e5871b4e7d96f3d639bc5708a3cf2dcd52616029387f40684fc1dd
SHA512a65b608c767244affe2f9c436d270998c56098b99522bc564c85cfd2adf4cb79d6172212ad5877859637bf265ada75bea479b961ae07769cab3b13329ca688d4
-
Filesize
1.2MB
MD538b986b1146fc342647e90847e6b6cef
SHA1af973b604ea10d87e3b68fee1e05536b699af79d
SHA256538cf37226e5871b4e7d96f3d639bc5708a3cf2dcd52616029387f40684fc1dd
SHA512a65b608c767244affe2f9c436d270998c56098b99522bc564c85cfd2adf4cb79d6172212ad5877859637bf265ada75bea479b961ae07769cab3b13329ca688d4