Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
Resource
win10v2004-20220812-en
General
-
Target
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
-
Size
1016KB
-
MD5
2ab2beedcf4290c6bab69d344ec0f3b0
-
SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3
-
SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
-
SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
SSDEEP
6144:TIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUPzo0zo:TIXsgtvm1De5YlOx6lzBH46UPzo0zo
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" iffdguquspp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" ehopt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ehopt.exe -
Adds policy Run key to start application 2 TTPs 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\opu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phdtmdyqlitzipbydqld.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\opu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rhbpgvoexsbfmrbwzk.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ptbdil = "exulfxtmigszjreciwsli.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\opu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctodvlfwqmwbjpawamg.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\opu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bphtivmarkrtybjc.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ptbdil = "ixqdthzogailrveya.exe" iffdguquspp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ptbdil = "ctodvlfwqmwbjpawamg.exe" ehopt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ptbdil = "ixqdthzogailrveya.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ptbdil = "phdtmdyqlitzipbydqld.exe" ehopt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run iffdguquspp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\opu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rhbpgvoexsbfmrbwzk.exe" iffdguquspp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\opu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exulfxtmigszjreciwsli.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ptbdil = "exulfxtmigszjreciwsli.exe" ehopt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ehopt.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iffdguquspp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ehopt.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ehopt.exe -
Executes dropped EXE 3 IoCs
pid Process 1548 iffdguquspp.exe 1280 ehopt.exe 676 ehopt.exe -
Loads dropped DLL 6 IoCs
pid Process 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1548 iffdguquspp.exe 1548 iffdguquspp.exe 1548 iffdguquspp.exe 1548 iffdguquspp.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "exulfxtmigszjreciwsli.exe ." ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "bphtivmarkrtybjc.exe ." ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxdd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bphtivmarkrtybjc.exe" iffdguquspp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\chqtzdl = "phdtmdyqlitzipbydqld.exe" ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bphtivmarkrtybjc.exe ." ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\chqtzdl = "ctodvlfwqmwbjpawamg.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vxdd = "rhbpgvoexsbfmrbwzk.exe" ehopt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ipafntdku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exulfxtmigszjreciwsli.exe ." ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exulfxtmigszjreciwsli.exe ." ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phdtmdyqlitzipbydqld.exe ." ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "exulfxtmigszjreciwsli.exe ." ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\chqtzdl = "rhbpgvoexsbfmrbwzk.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bjvbkrckvi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phdtmdyqlitzipbydqld.exe" iffdguquspp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\chqtzdl = "ixqdthzogailrveya.exe" ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rxhlsxgm = "exulfxtmigszjreciwsli.exe ." ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxdd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rhbpgvoexsbfmrbwzk.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ipafntdku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ixqdthzogailrveya.exe ." ehopt.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iffdguquspp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\chqtzdl = "ctodvlfwqmwbjpawamg.exe" iffdguquspp.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ehopt.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vxdd = "phdtmdyqlitzipbydqld.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bjvbkrckvi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phdtmdyqlitzipbydqld.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "bphtivmarkrtybjc.exe ." iffdguquspp.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce iffdguquspp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ipafntdku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exulfxtmigszjreciwsli.exe ." iffdguquspp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "ctodvlfwqmwbjpawamg.exe ." ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\chqtzdl = "ixqdthzogailrveya.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vxdd = "ixqdthzogailrveya.exe" ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\chqtzdl = "bphtivmarkrtybjc.exe" ehopt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce iffdguquspp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rxhlsxgm = "rhbpgvoexsbfmrbwzk.exe ." iffdguquspp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rxhlsxgm = "phdtmdyqlitzipbydqld.exe ." ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vxdd = "bphtivmarkrtybjc.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bjvbkrckvi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bphtivmarkrtybjc.exe" ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctodvlfwqmwbjpawamg.exe ." ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ipafntdku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phdtmdyqlitzipbydqld.exe ." ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vxdd = "phdtmdyqlitzipbydqld.exe" ehopt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iffdguquspp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vxdd = "ctodvlfwqmwbjpawamg.exe" iffdguquspp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exulfxtmigszjreciwsli.exe ." iffdguquspp.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxdd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phdtmdyqlitzipbydqld.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bjvbkrckvi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phdtmdyqlitzipbydqld.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ipafntdku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bphtivmarkrtybjc.exe ." ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "ixqdthzogailrveya.exe ." ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "rhbpgvoexsbfmrbwzk.exe ." ehopt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bjvbkrckvi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exulfxtmigszjreciwsli.exe" ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rxhlsxgm = "ixqdthzogailrveya.exe ." ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxdd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ixqdthzogailrveya.exe" ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\chqtzdl = "ctodvlfwqmwbjpawamg.exe" ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxdd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exulfxtmigszjreciwsli.exe" ehopt.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rxhlsxgm = "bphtivmarkrtybjc.exe ." ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ipafntdku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctodvlfwqmwbjpawamg.exe ." ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bjvbkrckvi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctodvlfwqmwbjpawamg.exe" ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rxhlsxgm = "ctodvlfwqmwbjpawamg.exe ." ehopt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ehopt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phdtmdyqlitzipbydqld.exe ." ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vxdd = "ctodvlfwqmwbjpawamg.exe" ehopt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bjvbkrckvi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ixqdthzogailrveya.exe" ehopt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ehopt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ehopt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iffdguquspp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iffdguquspp.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 www.showmyipaddress.com 7 whatismyip.everdot.org 10 whatismyipaddress.com -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rhbpgvoexsbfmrbwzk.exe ehopt.exe File opened for modification C:\Windows\SysWOW64\ctodvlfwqmwbjpawamg.exe ehopt.exe File opened for modification C:\Windows\SysWOW64\phdtmdyqlitzipbydqld.exe ehopt.exe File opened for modification C:\Windows\SysWOW64\vpnfatqkhgtbmvjipebvtl.exe ehopt.exe File opened for modification C:\Windows\SysWOW64\tdrzktgqdsvtutxmjoblzhsboyladbcbfu.wjt ehopt.exe File opened for modification C:\Windows\SysWOW64\rhbpgvoexsbfmrbwzk.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\bphtivmarkrtybjc.exe ehopt.exe File opened for modification C:\Windows\SysWOW64\exulfxtmigszjreciwsli.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\vpnfatqkhgtbmvjipebvtl.exe ehopt.exe File opened for modification C:\Windows\SysWOW64\bphtivmarkrtybjc.exe ehopt.exe File opened for modification C:\Windows\SysWOW64\exulfxtmigszjreciwsli.exe ehopt.exe File opened for modification C:\Windows\SysWOW64\gfiffdfegkcpftmqcwyxaxx.xwy ehopt.exe File opened for modification C:\Windows\SysWOW64\bphtivmarkrtybjc.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\ixqdthzogailrveya.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\vpnfatqkhgtbmvjipebvtl.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\ixqdthzogailrveya.exe ehopt.exe File opened for modification C:\Windows\SysWOW64\ctodvlfwqmwbjpawamg.exe ehopt.exe File created C:\Windows\SysWOW64\gfiffdfegkcpftmqcwyxaxx.xwy ehopt.exe File created C:\Windows\SysWOW64\tdrzktgqdsvtutxmjoblzhsboyladbcbfu.wjt ehopt.exe File opened for modification C:\Windows\SysWOW64\ctodvlfwqmwbjpawamg.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\phdtmdyqlitzipbydqld.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\ixqdthzogailrveya.exe ehopt.exe File opened for modification C:\Windows\SysWOW64\rhbpgvoexsbfmrbwzk.exe ehopt.exe File opened for modification C:\Windows\SysWOW64\phdtmdyqlitzipbydqld.exe ehopt.exe File opened for modification C:\Windows\SysWOW64\exulfxtmigszjreciwsli.exe ehopt.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\gfiffdfegkcpftmqcwyxaxx.xwy ehopt.exe File created C:\Program Files (x86)\gfiffdfegkcpftmqcwyxaxx.xwy ehopt.exe File opened for modification C:\Program Files (x86)\tdrzktgqdsvtutxmjoblzhsboyladbcbfu.wjt ehopt.exe File created C:\Program Files (x86)\tdrzktgqdsvtutxmjoblzhsboyladbcbfu.wjt ehopt.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\vpnfatqkhgtbmvjipebvtl.exe ehopt.exe File opened for modification C:\Windows\rhbpgvoexsbfmrbwzk.exe iffdguquspp.exe File opened for modification C:\Windows\exulfxtmigszjreciwsli.exe iffdguquspp.exe File opened for modification C:\Windows\rhbpgvoexsbfmrbwzk.exe ehopt.exe File opened for modification C:\Windows\exulfxtmigszjreciwsli.exe ehopt.exe File opened for modification C:\Windows\ixqdthzogailrveya.exe ehopt.exe File opened for modification C:\Windows\ctodvlfwqmwbjpawamg.exe iffdguquspp.exe File opened for modification C:\Windows\vpnfatqkhgtbmvjipebvtl.exe ehopt.exe File opened for modification C:\Windows\bphtivmarkrtybjc.exe ehopt.exe File opened for modification C:\Windows\phdtmdyqlitzipbydqld.exe ehopt.exe File created C:\Windows\gfiffdfegkcpftmqcwyxaxx.xwy ehopt.exe File opened for modification C:\Windows\exulfxtmigszjreciwsli.exe ehopt.exe File opened for modification C:\Windows\phdtmdyqlitzipbydqld.exe iffdguquspp.exe File opened for modification C:\Windows\vpnfatqkhgtbmvjipebvtl.exe iffdguquspp.exe File opened for modification C:\Windows\ixqdthzogailrveya.exe ehopt.exe File opened for modification C:\Windows\rhbpgvoexsbfmrbwzk.exe ehopt.exe File opened for modification C:\Windows\ctodvlfwqmwbjpawamg.exe ehopt.exe File opened for modification C:\Windows\gfiffdfegkcpftmqcwyxaxx.xwy ehopt.exe File opened for modification C:\Windows\tdrzktgqdsvtutxmjoblzhsboyladbcbfu.wjt ehopt.exe File created C:\Windows\tdrzktgqdsvtutxmjoblzhsboyladbcbfu.wjt ehopt.exe File opened for modification C:\Windows\bphtivmarkrtybjc.exe iffdguquspp.exe File opened for modification C:\Windows\ixqdthzogailrveya.exe iffdguquspp.exe File opened for modification C:\Windows\bphtivmarkrtybjc.exe ehopt.exe File opened for modification C:\Windows\ctodvlfwqmwbjpawamg.exe ehopt.exe File opened for modification C:\Windows\phdtmdyqlitzipbydqld.exe ehopt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1280 ehopt.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1280 ehopt.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1280 ehopt.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1536 wrote to memory of 1548 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 26 PID 1536 wrote to memory of 1548 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 26 PID 1536 wrote to memory of 1548 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 26 PID 1536 wrote to memory of 1548 1536 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 26 PID 1548 wrote to memory of 1280 1548 iffdguquspp.exe 28 PID 1548 wrote to memory of 1280 1548 iffdguquspp.exe 28 PID 1548 wrote to memory of 1280 1548 iffdguquspp.exe 28 PID 1548 wrote to memory of 1280 1548 iffdguquspp.exe 28 PID 1548 wrote to memory of 676 1548 iffdguquspp.exe 27 PID 1548 wrote to memory of 676 1548 iffdguquspp.exe 27 PID 1548 wrote to memory of 676 1548 iffdguquspp.exe 27 PID 1548 wrote to memory of 676 1548 iffdguquspp.exe 27 -
System policy modification 1 TTPs 30 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ehopt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" ehopt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iffdguquspp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" ehopt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ehopt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ehopt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ehopt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe"C:\Users\Admin\AppData\Local\Temp\78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe"C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe" "c:\users\admin\appdata\local\temp\78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\ehopt.exe"C:\Users\Admin\AppData\Local\Temp\ehopt.exe" "-C:\Users\Admin\AppData\Local\Temp\bphtivmarkrtybjc.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:676
-
-
C:\Users\Admin\AppData\Local\Temp\ehopt.exe"C:\Users\Admin\AppData\Local\Temp\ehopt.exe" "-C:\Users\Admin\AppData\Local\Temp\bphtivmarkrtybjc.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1280
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
704KB
MD5d533d95c515ac96df26d7deccb85c6f6
SHA15dcd61219f7febc8e195d19589fab2bba865f150
SHA2567b8ca0a4458de5472d79fade07df04d3ccb7f7afe6456ad50e14bf60ac69bac0
SHA512f5237ef05c62262d8da5c394944550f24ee57e8701f95be31dad3773e88d725a2199b84b07b62b831984b4caab2f3d7f57762de2829b102f26ead8aeff931e9a
-
Filesize
704KB
MD5d533d95c515ac96df26d7deccb85c6f6
SHA15dcd61219f7febc8e195d19589fab2bba865f150
SHA2567b8ca0a4458de5472d79fade07df04d3ccb7f7afe6456ad50e14bf60ac69bac0
SHA512f5237ef05c62262d8da5c394944550f24ee57e8701f95be31dad3773e88d725a2199b84b07b62b831984b4caab2f3d7f57762de2829b102f26ead8aeff931e9a
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
320KB
MD5048c1fcb9f1d3e881f57cbfb0762effb
SHA1f8b5758e262685cb4e5ebf264e9da77681ad49bf
SHA2561be8e9cca19143b913cc2698ca8c1eca8d67fe50b698d0093a7c8c8a4885b54d
SHA51282826d4b2c6ee4064c889dc293de465d3df5ebbd16c4301fb5e1a90d9e5b0ac86fac983d5cb58a361a2b740f1d18b3575a46a706c7b2842a1f45266b6c716519
-
Filesize
320KB
MD5048c1fcb9f1d3e881f57cbfb0762effb
SHA1f8b5758e262685cb4e5ebf264e9da77681ad49bf
SHA2561be8e9cca19143b913cc2698ca8c1eca8d67fe50b698d0093a7c8c8a4885b54d
SHA51282826d4b2c6ee4064c889dc293de465d3df5ebbd16c4301fb5e1a90d9e5b0ac86fac983d5cb58a361a2b740f1d18b3575a46a706c7b2842a1f45266b6c716519
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
704KB
MD5d533d95c515ac96df26d7deccb85c6f6
SHA15dcd61219f7febc8e195d19589fab2bba865f150
SHA2567b8ca0a4458de5472d79fade07df04d3ccb7f7afe6456ad50e14bf60ac69bac0
SHA512f5237ef05c62262d8da5c394944550f24ee57e8701f95be31dad3773e88d725a2199b84b07b62b831984b4caab2f3d7f57762de2829b102f26ead8aeff931e9a
-
Filesize
704KB
MD5d533d95c515ac96df26d7deccb85c6f6
SHA15dcd61219f7febc8e195d19589fab2bba865f150
SHA2567b8ca0a4458de5472d79fade07df04d3ccb7f7afe6456ad50e14bf60ac69bac0
SHA512f5237ef05c62262d8da5c394944550f24ee57e8701f95be31dad3773e88d725a2199b84b07b62b831984b4caab2f3d7f57762de2829b102f26ead8aeff931e9a
-
Filesize
704KB
MD5d533d95c515ac96df26d7deccb85c6f6
SHA15dcd61219f7febc8e195d19589fab2bba865f150
SHA2567b8ca0a4458de5472d79fade07df04d3ccb7f7afe6456ad50e14bf60ac69bac0
SHA512f5237ef05c62262d8da5c394944550f24ee57e8701f95be31dad3773e88d725a2199b84b07b62b831984b4caab2f3d7f57762de2829b102f26ead8aeff931e9a
-
Filesize
704KB
MD5d533d95c515ac96df26d7deccb85c6f6
SHA15dcd61219f7febc8e195d19589fab2bba865f150
SHA2567b8ca0a4458de5472d79fade07df04d3ccb7f7afe6456ad50e14bf60ac69bac0
SHA512f5237ef05c62262d8da5c394944550f24ee57e8701f95be31dad3773e88d725a2199b84b07b62b831984b4caab2f3d7f57762de2829b102f26ead8aeff931e9a
-
Filesize
320KB
MD5048c1fcb9f1d3e881f57cbfb0762effb
SHA1f8b5758e262685cb4e5ebf264e9da77681ad49bf
SHA2561be8e9cca19143b913cc2698ca8c1eca8d67fe50b698d0093a7c8c8a4885b54d
SHA51282826d4b2c6ee4064c889dc293de465d3df5ebbd16c4301fb5e1a90d9e5b0ac86fac983d5cb58a361a2b740f1d18b3575a46a706c7b2842a1f45266b6c716519
-
Filesize
320KB
MD5048c1fcb9f1d3e881f57cbfb0762effb
SHA1f8b5758e262685cb4e5ebf264e9da77681ad49bf
SHA2561be8e9cca19143b913cc2698ca8c1eca8d67fe50b698d0093a7c8c8a4885b54d
SHA51282826d4b2c6ee4064c889dc293de465d3df5ebbd16c4301fb5e1a90d9e5b0ac86fac983d5cb58a361a2b740f1d18b3575a46a706c7b2842a1f45266b6c716519