Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
16-11-2022 05:38
Behavioral task
behavioral1
Sample
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
Resource
win10v2004-20220812-en
General
-
Target
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
-
Size
719KB
-
MD5
8474039d83805eb7b447325c3a8d1ebb
-
SHA1
a07d537f4253745a087709a9a07c449f84deed8d
-
SHA256
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
-
SHA512
3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438
-
SSDEEP
12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html
Signatures
-
Detect Neshta payload 1 IoCs
Processes:
resource yara_rule C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE family_neshta -
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe family_medusalocker C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe family_medusalocker C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe family_medusalocker C:\Users\Admin\AppData\Roaming\svhost.exe family_medusalocker \Users\Admin\AppData\Roaming\svhost.exe family_medusalocker C:\Users\Admin\AppData\Roaming\svhost.exe family_medusalocker -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exesvhost.exepid process 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1112 svhost.exe -
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exedescription ioc process File renamed C:\Users\Admin\Pictures\CloseUnblock.crw => C:\Users\Admin\Pictures\CloseUnblock.crw.ReadInstructions b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\Users\Admin\Pictures\DenyConvert.tiff b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File renamed C:\Users\Admin\Pictures\DenyConvert.tiff => C:\Users\Admin\Pictures\DenyConvert.tiff.ReadInstructions b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File renamed C:\Users\Admin\Pictures\InvokeReceive.png => C:\Users\Admin\Pictures\InvokeReceive.png.ReadInstructions b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File renamed C:\Users\Admin\Pictures\RenameAdd.tiff => C:\Users\Admin\Pictures\RenameAdd.tiff.ReadInstructions b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File renamed C:\Users\Admin\Pictures\SkipDebug.tif => C:\Users\Admin\Pictures\SkipDebug.tif.ReadInstructions b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File renamed C:\Users\Admin\Pictures\SuspendShow.png => C:\Users\Admin\Pictures\SuspendShow.png.ReadInstructions b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File renamed C:\Users\Admin\Pictures\UnregisterImport.png => C:\Users\Admin\Pictures\UnregisterImport.png.ReadInstructions b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File renamed C:\Users\Admin\Pictures\UseAssert.crw => C:\Users\Admin\Pictures\UseAssert.crw.ReadInstructions b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File renamed C:\Users\Admin\Pictures\HideGrant.crw => C:\Users\Admin\Pictures\HideGrant.crw.ReadInstructions b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\Users\Admin\Pictures\RenameAdd.tiff b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File renamed C:\Users\Admin\Pictures\WaitMove.raw => C:\Users\Admin\Pictures\WaitMove.raw.ReadInstructions b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe -
Loads dropped DLL 3 IoCs
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exepid process 1308 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1308 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1308 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exedescription ioc process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3406023954-474543476-3319432036-1000\desktop.ini b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exedescription ioc process File opened (read-only) \??\T: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\A: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\I: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\L: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\M: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\N: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\Q: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\R: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\X: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\E: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\G: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\H: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\B: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\J: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\U: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\W: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\Z: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\F: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\K: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\O: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\P: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\S: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\V: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened (read-only) \??\Y: b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe -
Drops file in Program Files directory 64 IoCs
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exedescription ioc process File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe -
Drops file in Windows directory 1 IoCs
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exedescription ioc process File opened for modification C:\Windows\svchost.com b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid process 1128 vssadmin.exe 776 vssadmin.exe 1116 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exepid process 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
vssvc.exewmic.exewmic.exewmic.exedescription pid process Token: SeBackupPrivilege 1764 vssvc.exe Token: SeRestorePrivilege 1764 vssvc.exe Token: SeAuditPrivilege 1764 vssvc.exe Token: SeIncreaseQuotaPrivilege 1580 wmic.exe Token: SeSecurityPrivilege 1580 wmic.exe Token: SeTakeOwnershipPrivilege 1580 wmic.exe Token: SeLoadDriverPrivilege 1580 wmic.exe Token: SeSystemProfilePrivilege 1580 wmic.exe Token: SeSystemtimePrivilege 1580 wmic.exe Token: SeProfSingleProcessPrivilege 1580 wmic.exe Token: SeIncBasePriorityPrivilege 1580 wmic.exe Token: SeCreatePagefilePrivilege 1580 wmic.exe Token: SeBackupPrivilege 1580 wmic.exe Token: SeRestorePrivilege 1580 wmic.exe Token: SeShutdownPrivilege 1580 wmic.exe Token: SeDebugPrivilege 1580 wmic.exe Token: SeSystemEnvironmentPrivilege 1580 wmic.exe Token: SeRemoteShutdownPrivilege 1580 wmic.exe Token: SeUndockPrivilege 1580 wmic.exe Token: SeManageVolumePrivilege 1580 wmic.exe Token: 33 1580 wmic.exe Token: 34 1580 wmic.exe Token: 35 1580 wmic.exe Token: SeIncreaseQuotaPrivilege 800 wmic.exe Token: SeSecurityPrivilege 800 wmic.exe Token: SeTakeOwnershipPrivilege 800 wmic.exe Token: SeLoadDriverPrivilege 800 wmic.exe Token: SeSystemProfilePrivilege 800 wmic.exe Token: SeSystemtimePrivilege 800 wmic.exe Token: SeProfSingleProcessPrivilege 800 wmic.exe Token: SeIncBasePriorityPrivilege 800 wmic.exe Token: SeCreatePagefilePrivilege 800 wmic.exe Token: SeBackupPrivilege 800 wmic.exe Token: SeRestorePrivilege 800 wmic.exe Token: SeShutdownPrivilege 800 wmic.exe Token: SeDebugPrivilege 800 wmic.exe Token: SeSystemEnvironmentPrivilege 800 wmic.exe Token: SeRemoteShutdownPrivilege 800 wmic.exe Token: SeUndockPrivilege 800 wmic.exe Token: SeManageVolumePrivilege 800 wmic.exe Token: 33 800 wmic.exe Token: 34 800 wmic.exe Token: 35 800 wmic.exe Token: SeIncreaseQuotaPrivilege 1884 wmic.exe Token: SeSecurityPrivilege 1884 wmic.exe Token: SeTakeOwnershipPrivilege 1884 wmic.exe Token: SeLoadDriverPrivilege 1884 wmic.exe Token: SeSystemProfilePrivilege 1884 wmic.exe Token: SeSystemtimePrivilege 1884 wmic.exe Token: SeProfSingleProcessPrivilege 1884 wmic.exe Token: SeIncBasePriorityPrivilege 1884 wmic.exe Token: SeCreatePagefilePrivilege 1884 wmic.exe Token: SeBackupPrivilege 1884 wmic.exe Token: SeRestorePrivilege 1884 wmic.exe Token: SeShutdownPrivilege 1884 wmic.exe Token: SeDebugPrivilege 1884 wmic.exe Token: SeSystemEnvironmentPrivilege 1884 wmic.exe Token: SeRemoteShutdownPrivilege 1884 wmic.exe Token: SeUndockPrivilege 1884 wmic.exe Token: SeManageVolumePrivilege 1884 wmic.exe Token: 33 1884 wmic.exe Token: 34 1884 wmic.exe Token: 35 1884 wmic.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exeb2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exetaskeng.exedescription pid process target process PID 1308 wrote to memory of 1172 1308 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe PID 1308 wrote to memory of 1172 1308 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe PID 1308 wrote to memory of 1172 1308 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe PID 1308 wrote to memory of 1172 1308 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe PID 1172 wrote to memory of 776 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe vssadmin.exe PID 1172 wrote to memory of 776 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe vssadmin.exe PID 1172 wrote to memory of 776 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe vssadmin.exe PID 1172 wrote to memory of 776 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe vssadmin.exe PID 1172 wrote to memory of 1580 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe wmic.exe PID 1172 wrote to memory of 1580 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe wmic.exe PID 1172 wrote to memory of 1580 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe wmic.exe PID 1172 wrote to memory of 1580 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe wmic.exe PID 1172 wrote to memory of 1116 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe vssadmin.exe PID 1172 wrote to memory of 1116 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe vssadmin.exe PID 1172 wrote to memory of 1116 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe vssadmin.exe PID 1172 wrote to memory of 1116 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe vssadmin.exe PID 1172 wrote to memory of 800 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe wmic.exe PID 1172 wrote to memory of 800 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe wmic.exe PID 1172 wrote to memory of 800 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe wmic.exe PID 1172 wrote to memory of 800 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe wmic.exe PID 1172 wrote to memory of 1128 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe vssadmin.exe PID 1172 wrote to memory of 1128 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe vssadmin.exe PID 1172 wrote to memory of 1128 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe vssadmin.exe PID 1172 wrote to memory of 1128 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe vssadmin.exe PID 1172 wrote to memory of 1884 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe wmic.exe PID 1172 wrote to memory of 1884 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe wmic.exe PID 1172 wrote to memory of 1884 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe wmic.exe PID 1172 wrote to memory of 1884 1172 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe wmic.exe PID 2044 wrote to memory of 1112 2044 taskeng.exe svhost.exe PID 2044 wrote to memory of 1112 2044 taskeng.exe svhost.exe PID 2044 wrote to memory of 1112 2044 taskeng.exe svhost.exe PID 2044 wrote to memory of 1112 2044 taskeng.exe svhost.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1172 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:776
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:1116
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:800
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:1128
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
C:\Windows\system32\taskeng.exetaskeng.exe {61685563-BC94-465C-A2EC-E051330ED48C} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:1112
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
864KB
MD55249a3355d734bdccbf450af1a3affdf
SHA1acfebe52359b0691cc0dc729828e7d580aa8c385
SHA256362f098849cf692192daedfc660e7d69cee61172f1b3d838fb026e8fa319cf08
SHA5125782a57bebfb620e77513790bb5a001273891f45caf0c52548ee32ddfa97fc3f07fc5997e5975d8c957c4f6f55af6735adc8690116044b2993887e67fa744de0
-
C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
Filesize678KB
MD55aa0a571567f8437556e9b00ae5a3532
SHA145377cb152832c9112db7909219fa87a6e760aae
SHA25673549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
SHA512d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec
-
C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
Filesize678KB
MD55aa0a571567f8437556e9b00ae5a3532
SHA145377cb152832c9112db7909219fa87a6e760aae
SHA25673549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
SHA512d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec
-
Filesize
678KB
MD55aa0a571567f8437556e9b00ae5a3532
SHA145377cb152832c9112db7909219fa87a6e760aae
SHA25673549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
SHA512d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec
-
Filesize
678KB
MD55aa0a571567f8437556e9b00ae5a3532
SHA145377cb152832c9112db7909219fa87a6e760aae
SHA25673549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
SHA512d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
Filesize678KB
MD55aa0a571567f8437556e9b00ae5a3532
SHA145377cb152832c9112db7909219fa87a6e760aae
SHA25673549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
SHA512d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec
-
Filesize
678KB
MD55aa0a571567f8437556e9b00ae5a3532
SHA145377cb152832c9112db7909219fa87a6e760aae
SHA25673549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
SHA512d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec