Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 23:53
Static task
static1
Behavioral task
behavioral1
Sample
6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe
Resource
win10v2004-20220901-en
General
-
Target
6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe
-
Size
320KB
-
MD5
04b4b2f130705e6e22e4b940f5df3a90
-
SHA1
d1ea0bf314bfb75b669bae9e2750fd55fe41077a
-
SHA256
6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb
-
SHA512
28fc9a38f7e73f09f75de2d73e99983875967140fd3a80330ddfa63351d0ffb97b5bc83acb9ddf2c55b503b857231044211eaa038aab0fc1304d99702657fc57
-
SSDEEP
6144:jTw1o1IV3puaibGKFHi0mofhaH05kipz016580bHFP86JQPDHDdx/QtqR:nTgvmzFHi0mo5aH0qMzd5807FPPJQPDV
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" ktyahr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ktyahr.exe -
Adds policy Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odowjzgsgqck = "wpeqhbmcuiykrptb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odowjzgsgqck = "wpeqhbmcuiykrptb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dpxcmzdmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxriedtolezqcfobinnlf.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dpxcmzdmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpeqhbmcuiykrptb.exe" ktyahr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dpxcmzdmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxnasnzqjypckjoxa.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dpxcmzdmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtlaurfytkdscdkvadb.exe" ktyahr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dpxcmzdmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhymfbogaqiwfflvzb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odowjzgsgqck = "zxriedtolezqcfobinnlf.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odowjzgsgqck = "khaqljysogaqbdlxdhgd.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dpxcmzdmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khaqljysogaqbdlxdhgd.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odowjzgsgqck = "xtlaurfytkdscdkvadb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odowjzgsgqck = "dxnasnzqjypckjoxa.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dpxcmzdmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxnasnzqjypckjoxa.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odowjzgsgqck = "mhymfbogaqiwfflvzb.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odowjzgsgqck = "mhymfbogaqiwfflvzb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odowjzgsgqck = "khaqljysogaqbdlxdhgd.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dpxcmzdmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxnasnzqjypckjoxa.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odowjzgsgqck = "dxnasnzqjypckjoxa.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dpxcmzdmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpeqhbmcuiykrptb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odowjzgsgqck = "xtlaurfytkdscdkvadb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dpxcmzdmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtlaurfytkdscdkvadb.exe" ktyahr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dpxcmzdmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhymfbogaqiwfflvzb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odowjzgsgqck = "zxriedtolezqcfobinnlf.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dpxcmzdmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhymfbogaqiwfflvzb.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ktyahr.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ktyahr.exe -
Executes dropped EXE 2 IoCs
pid Process 3188 ktyahr.exe 692 ktyahr.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ofscrjsgwiwglh = "mhymfbogaqiwfflvzb.exe ." ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khaqljysogaqbdlxdhgd.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rjxiyrbqhujuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khaqljysogaqbdlxdhgd.exe ." ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wpeqhbmcuiykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khaqljysogaqbdlxdhgd.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "wpeqhbmcuiykrptb.exe ." ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wpeqhbmcuiykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtlaurfytkdscdkvadb.exe" ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ndpymdlynyluy = "xtlaurfytkdscdkvadb.exe" ktyahr.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ofscrjsgwiwglh = "xtlaurfytkdscdkvadb.exe ." ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "wpeqhbmcuiykrptb.exe ." 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpeqhbmcuiykrptb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rjxiyrbqhujuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxriedtolezqcfobinnlf.exe ." ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khaqljysogaqbdlxdhgd.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "mhymfbogaqiwfflvzb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rjxiyrbqhujuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpeqhbmcuiykrptb.exe ." ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ndpymdlynyluy = "khaqljysogaqbdlxdhgd.exe" ktyahr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "wpeqhbmcuiykrptb.exe ." ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ndpymdlynyluy = "khaqljysogaqbdlxdhgd.exe" ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khaqljysogaqbdlxdhgd.exe ." ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rjxiyrbqhujuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtlaurfytkdscdkvadb.exe ." 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtlaurfytkdscdkvadb.exe ." ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ofscrjsgwiwglh = "dxnasnzqjypckjoxa.exe ." ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhymfbogaqiwfflvzb.exe ." ktyahr.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "xtlaurfytkdscdkvadb.exe" ktyahr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhymfbogaqiwfflvzb.exe ." 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtlaurfytkdscdkvadb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wpeqhbmcuiykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxnasnzqjypckjoxa.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wpeqhbmcuiykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khaqljysogaqbdlxdhgd.exe" ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ndpymdlynyluy = "dxnasnzqjypckjoxa.exe" ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxnasnzqjypckjoxa.exe" ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxriedtolezqcfobinnlf.exe ." ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ndpymdlynyluy = "wpeqhbmcuiykrptb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rjxiyrbqhujuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxnasnzqjypckjoxa.exe ." 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "xtlaurfytkdscdkvadb.exe ." ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ndpymdlynyluy = "mhymfbogaqiwfflvzb.exe" ktyahr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "wpeqhbmcuiykrptb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wpeqhbmcuiykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxnasnzqjypckjoxa.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "wpeqhbmcuiykrptb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "zxriedtolezqcfobinnlf.exe" ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxriedtolezqcfobinnlf.exe ." 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "mhymfbogaqiwfflvzb.exe ." ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxriedtolezqcfobinnlf.exe ." ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "dxnasnzqjypckjoxa.exe ." 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhymfbogaqiwfflvzb.exe ." ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ofscrjsgwiwglh = "zxriedtolezqcfobinnlf.exe ." ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wpeqhbmcuiykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxriedtolezqcfobinnlf.exe" ktyahr.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxnasnzqjypckjoxa.exe" ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ofscrjsgwiwglh = "khaqljysogaqbdlxdhgd.exe ." ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rjxiyrbqhujuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxnasnzqjypckjoxa.exe ." ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rjxiyrbqhujuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtlaurfytkdscdkvadb.exe ." ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "zxriedtolezqcfobinnlf.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhymfbogaqiwfflvzb.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtlaurfytkdscdkvadb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "khaqljysogaqbdlxdhgd.exe ." ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wjsyjxcmyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhymfbogaqiwfflvzb.exe" ktyahr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfpwixdobkv = "dxnasnzqjypckjoxa.exe ." ktyahr.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ofscrjsgwiwglh = "zxriedtolezqcfobinnlf.exe ." ktyahr.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ktyahr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ktyahr.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 27 whatismyip.everdot.org 45 www.showmyipaddress.com 9 whatismyipaddress.com 21 whatismyip.everdot.org -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\qxaafnmqwyccxjbxnbkruuzhgk.sww ktyahr.exe File opened for modification C:\Windows\SysWOW64\rjxiyrbqhujuaxahihbthsiblaretekhkrsrl.rcs ktyahr.exe File created C:\Windows\SysWOW64\rjxiyrbqhujuaxahihbthsiblaretekhkrsrl.rcs ktyahr.exe File opened for modification C:\Windows\SysWOW64\qxaafnmqwyccxjbxnbkruuzhgk.sww ktyahr.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\rjxiyrbqhujuaxahihbthsiblaretekhkrsrl.rcs ktyahr.exe File opened for modification C:\Program Files (x86)\qxaafnmqwyccxjbxnbkruuzhgk.sww ktyahr.exe File created C:\Program Files (x86)\qxaafnmqwyccxjbxnbkruuzhgk.sww ktyahr.exe File opened for modification C:\Program Files (x86)\rjxiyrbqhujuaxahihbthsiblaretekhkrsrl.rcs ktyahr.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\qxaafnmqwyccxjbxnbkruuzhgk.sww ktyahr.exe File created C:\Windows\qxaafnmqwyccxjbxnbkruuzhgk.sww ktyahr.exe File opened for modification C:\Windows\rjxiyrbqhujuaxahihbthsiblaretekhkrsrl.rcs ktyahr.exe File created C:\Windows\rjxiyrbqhujuaxahihbthsiblaretekhkrsrl.rcs ktyahr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings ktyahr.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings ktyahr.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe 3188 ktyahr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 692 ktyahr.exe 3188 ktyahr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3188 ktyahr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3068 wrote to memory of 3188 3068 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 81 PID 3068 wrote to memory of 3188 3068 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 81 PID 3068 wrote to memory of 3188 3068 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 81 PID 3068 wrote to memory of 692 3068 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 82 PID 3068 wrote to memory of 692 3068 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 82 PID 3068 wrote to memory of 692 3068 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 82 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" ktyahr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" ktyahr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" ktyahr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" ktyahr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ktyahr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" ktyahr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe"C:\Users\Admin\AppData\Local\Temp\6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\ktyahr.exe"C:\Users\Admin\AppData\Local\Temp\ktyahr.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3188
-
-
C:\Users\Admin\AppData\Local\Temp\ktyahr.exe"C:\Users\Admin\AppData\Local\Temp\ktyahr.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:692
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1404
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
692KB
MD5efc7200c8b6294eed90d23c817e9a06d
SHA13502afe415884fb20c4809ffecaedcf76a346f98
SHA25615d1c21cf3acea6701d5fa2a658dbbd7f9ac68c2687752de7cdebee1838aaf9e
SHA5120e0e8e4708f9fe70ff220ddd16666c35b5310d26c0bba62dd2df4115ab75d65a87c15858e3dea52de4427e5208fa38538fbe02a3b8a6a96f353e3fb2e030cff2
-
Filesize
692KB
MD5efc7200c8b6294eed90d23c817e9a06d
SHA13502afe415884fb20c4809ffecaedcf76a346f98
SHA25615d1c21cf3acea6701d5fa2a658dbbd7f9ac68c2687752de7cdebee1838aaf9e
SHA5120e0e8e4708f9fe70ff220ddd16666c35b5310d26c0bba62dd2df4115ab75d65a87c15858e3dea52de4427e5208fa38538fbe02a3b8a6a96f353e3fb2e030cff2
-
Filesize
692KB
MD5efc7200c8b6294eed90d23c817e9a06d
SHA13502afe415884fb20c4809ffecaedcf76a346f98
SHA25615d1c21cf3acea6701d5fa2a658dbbd7f9ac68c2687752de7cdebee1838aaf9e
SHA5120e0e8e4708f9fe70ff220ddd16666c35b5310d26c0bba62dd2df4115ab75d65a87c15858e3dea52de4427e5208fa38538fbe02a3b8a6a96f353e3fb2e030cff2