Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-12-2022 10:19
Behavioral task
behavioral1
Sample
2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe
Resource
win10v2004-20220812-en
General
-
Target
2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe
-
Size
610KB
-
MD5
1c73c307773fedfccd544a6b6b0b55b9
-
SHA1
899ffd934e0b8a6df4b115c49df33fca524e2135
-
SHA256
2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376
-
SHA512
049211f9d07e3cca9f92dfb1bc2e0f6895586f9f36b2651ffb2de20f3573ba9d719aff27e67b996f4706852578e919810e3e6854eebf0aaff0d412d8cabc127d
-
SSDEEP
12288:mT9zGQU31phksyH0F8eHSE3BGAFTT/OAchocfoOG6FTvcDldnozRpXFqOO:mRyQUlGuLSE3BGAF//xlcfoO/IDr6FqO
Malware Config
Extracted
http://myexternalip.com/raw
Signatures
-
Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
description ioc Process File created C:\Program Files\VideoLAN\VLC\plugins\spu\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VYXNV57O\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pe9iawd3.default-release\datareporting\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Microsoft Games\More Games\en-US\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\Music\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\VideoLAN\VLC\plugins\lua\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\Saved Games\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Esl\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Microsoft Games\FreeCell\de-DE\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pe9iawd3.default-release\cache2\entries\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1214520366-621468234-4062160515-1000\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Users\Public\Documents\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 644 bcdedit.exe 1496 bcdedit.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 8 1888 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS KTNdBnz764.exe -
Executes dropped EXE 3 IoCs
pid Process 900 NWZSnoAf.exe 1752 KTNdBnz7.exe 1764 KTNdBnz764.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\DisconnectUnregister.tiff 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Pictures\EnterStart.tiff 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" KTNdBnz764.exe -
resource yara_rule behavioral1/files/0x000b000000012304-56.dat upx behavioral1/files/0x000b000000012304-57.dat upx behavioral1/files/0x000b000000012304-58.dat upx behavioral1/files/0x000b000000012304-60.dat upx behavioral1/memory/1720-62-0x0000000000400000-0x0000000000582000-memory.dmp upx behavioral1/memory/900-64-0x0000000000400000-0x0000000000582000-memory.dmp upx behavioral1/memory/1720-81-0x0000000000400000-0x0000000000582000-memory.dmp upx behavioral1/memory/900-84-0x0000000000400000-0x0000000000582000-memory.dmp upx behavioral1/files/0x0008000000012328-94.dat upx behavioral1/files/0x0008000000012328-93.dat upx behavioral1/files/0x0008000000012328-97.dat upx behavioral1/memory/1752-103-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral1/memory/900-104-0x0000000000400000-0x0000000000582000-memory.dmp upx -
Loads dropped DLL 4 IoCs
pid Process 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 700 cmd.exe 1752 KTNdBnz7.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 272 takeown.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 42 IoCs
description ioc Process File opened for modification C:\Users\Public\Music\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\9M5JJ10P\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZNYHOEOL\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\CYEXZCX2\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VYXNV57O\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1214520366-621468234-4062160515-1000\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Public\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\N: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\I: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\F: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\G: KTNdBnz764.exe File opened (read-only) \??\S: KTNdBnz764.exe File opened (read-only) \??\T: KTNdBnz764.exe File opened (read-only) \??\V: KTNdBnz764.exe File opened (read-only) \??\Y: KTNdBnz764.exe File opened (read-only) \??\E: KTNdBnz764.exe File opened (read-only) \??\L: KTNdBnz764.exe File opened (read-only) \??\O: KTNdBnz764.exe File opened (read-only) \??\P: KTNdBnz764.exe File opened (read-only) \??\X: KTNdBnz764.exe File opened (read-only) \??\V: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\G: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\I: KTNdBnz764.exe File opened (read-only) \??\Z: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\X: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\T: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\P: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\O: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\M: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\L: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\H: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\A: KTNdBnz764.exe File opened (read-only) \??\H: KTNdBnz764.exe File opened (read-only) \??\Q: KTNdBnz764.exe File opened (read-only) \??\R: KTNdBnz764.exe File opened (read-only) \??\U: KTNdBnz764.exe File opened (read-only) \??\Y: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\U: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\R: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\J: KTNdBnz764.exe File opened (read-only) \??\K: KTNdBnz764.exe File opened (read-only) \??\W: KTNdBnz764.exe File opened (read-only) \??\S: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\E: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\F: KTNdBnz764.exe File opened (read-only) \??\N: KTNdBnz764.exe File opened (read-only) \??\K: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\J: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\M: KTNdBnz764.exe File opened (read-only) \??\W: 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened (read-only) \??\B: KTNdBnz764.exe File opened (read-only) \??\Z: KTNdBnz764.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 myexternalip.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\xyIMhA14.bmp" reg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Almaty 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239975.WMF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LTHD98.POC 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14756_.GIF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00494_.WMF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Moscow 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid.gif 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Beige.css 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Microsoft Games\Hearts\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Menominee 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10300_.GIF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WORDREP.DPV 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00419_.WMF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232395.WMF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00132_.WMF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClient.resources.dll 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0217302.WMF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02270_.WMF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jre7\lib\security\javafx.policy 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\EXITEML.ICO 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Java\jre7\lib\images\cursors\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\STORYVERTBB.POC 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jre7\lib\logging.properties 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RESENDL.ICO 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jre7\lib\rt.jar 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241781.WMF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Perspective.thmx 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File created C:\Program Files\Microsoft Games\FreeCell\de-DE\#FOX_README#.rtf 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDEBARBB.DPV 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0199036.WMF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LETTHEAD.DPV 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_is.dll 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBOXES.XML 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\INDST_01.MID 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_06.MID 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21519_.GIF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02285_.WMF 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GR8GALRY.GRA 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1488 schtasks.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1252 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1888 powershell.exe 1764 KTNdBnz764.exe 1764 KTNdBnz764.exe 1764 KTNdBnz764.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1764 KTNdBnz764.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1888 powershell.exe Token: SeDebugPrivilege 1764 KTNdBnz764.exe Token: SeLoadDriverPrivilege 1764 KTNdBnz764.exe Token: SeBackupPrivilege 1584 vssvc.exe Token: SeRestorePrivilege 1584 vssvc.exe Token: SeAuditPrivilege 1584 vssvc.exe Token: SeIncreaseQuotaPrivilege 1884 WMIC.exe Token: SeSecurityPrivilege 1884 WMIC.exe Token: SeTakeOwnershipPrivilege 1884 WMIC.exe Token: SeLoadDriverPrivilege 1884 WMIC.exe Token: SeSystemProfilePrivilege 1884 WMIC.exe Token: SeSystemtimePrivilege 1884 WMIC.exe Token: SeProfSingleProcessPrivilege 1884 WMIC.exe Token: SeIncBasePriorityPrivilege 1884 WMIC.exe Token: SeCreatePagefilePrivilege 1884 WMIC.exe Token: SeBackupPrivilege 1884 WMIC.exe Token: SeRestorePrivilege 1884 WMIC.exe Token: SeShutdownPrivilege 1884 WMIC.exe Token: SeDebugPrivilege 1884 WMIC.exe Token: SeSystemEnvironmentPrivilege 1884 WMIC.exe Token: SeRemoteShutdownPrivilege 1884 WMIC.exe Token: SeUndockPrivilege 1884 WMIC.exe Token: SeManageVolumePrivilege 1884 WMIC.exe Token: 33 1884 WMIC.exe Token: 34 1884 WMIC.exe Token: 35 1884 WMIC.exe Token: SeIncreaseQuotaPrivilege 1884 WMIC.exe Token: SeSecurityPrivilege 1884 WMIC.exe Token: SeTakeOwnershipPrivilege 1884 WMIC.exe Token: SeLoadDriverPrivilege 1884 WMIC.exe Token: SeSystemProfilePrivilege 1884 WMIC.exe Token: SeSystemtimePrivilege 1884 WMIC.exe Token: SeProfSingleProcessPrivilege 1884 WMIC.exe Token: SeIncBasePriorityPrivilege 1884 WMIC.exe Token: SeCreatePagefilePrivilege 1884 WMIC.exe Token: SeBackupPrivilege 1884 WMIC.exe Token: SeRestorePrivilege 1884 WMIC.exe Token: SeShutdownPrivilege 1884 WMIC.exe Token: SeDebugPrivilege 1884 WMIC.exe Token: SeSystemEnvironmentPrivilege 1884 WMIC.exe Token: SeRemoteShutdownPrivilege 1884 WMIC.exe Token: SeUndockPrivilege 1884 WMIC.exe Token: SeManageVolumePrivilege 1884 WMIC.exe Token: 33 1884 WMIC.exe Token: 34 1884 WMIC.exe Token: 35 1884 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2040 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 29 PID 1720 wrote to memory of 2040 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 29 PID 1720 wrote to memory of 2040 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 29 PID 1720 wrote to memory of 2040 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 29 PID 1720 wrote to memory of 900 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 31 PID 1720 wrote to memory of 900 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 31 PID 1720 wrote to memory of 900 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 31 PID 1720 wrote to memory of 900 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 31 PID 1720 wrote to memory of 336 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 33 PID 1720 wrote to memory of 336 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 33 PID 1720 wrote to memory of 336 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 33 PID 1720 wrote to memory of 336 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 33 PID 336 wrote to memory of 1888 336 cmd.exe 35 PID 336 wrote to memory of 1888 336 cmd.exe 35 PID 336 wrote to memory of 1888 336 cmd.exe 35 PID 336 wrote to memory of 1888 336 cmd.exe 35 PID 1720 wrote to memory of 1956 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 36 PID 1720 wrote to memory of 1956 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 36 PID 1720 wrote to memory of 1956 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 36 PID 1720 wrote to memory of 1956 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 36 PID 1720 wrote to memory of 552 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 38 PID 1720 wrote to memory of 552 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 38 PID 1720 wrote to memory of 552 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 38 PID 1720 wrote to memory of 552 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 38 PID 1956 wrote to memory of 1568 1956 cmd.exe 40 PID 1956 wrote to memory of 1568 1956 cmd.exe 40 PID 1956 wrote to memory of 1568 1956 cmd.exe 40 PID 1956 wrote to memory of 1568 1956 cmd.exe 40 PID 1956 wrote to memory of 1544 1956 cmd.exe 42 PID 1956 wrote to memory of 1544 1956 cmd.exe 42 PID 1956 wrote to memory of 1544 1956 cmd.exe 42 PID 1956 wrote to memory of 1544 1956 cmd.exe 42 PID 552 wrote to memory of 1416 552 cmd.exe 41 PID 552 wrote to memory of 1416 552 cmd.exe 41 PID 552 wrote to memory of 1416 552 cmd.exe 41 PID 552 wrote to memory of 1416 552 cmd.exe 41 PID 1956 wrote to memory of 1176 1956 cmd.exe 43 PID 1956 wrote to memory of 1176 1956 cmd.exe 43 PID 1956 wrote to memory of 1176 1956 cmd.exe 43 PID 1956 wrote to memory of 1176 1956 cmd.exe 43 PID 1416 wrote to memory of 1752 1416 wscript.exe 44 PID 1416 wrote to memory of 1752 1416 wscript.exe 44 PID 1416 wrote to memory of 1752 1416 wscript.exe 44 PID 1416 wrote to memory of 1752 1416 wscript.exe 44 PID 1752 wrote to memory of 1488 1752 cmd.exe 46 PID 1752 wrote to memory of 1488 1752 cmd.exe 46 PID 1752 wrote to memory of 1488 1752 cmd.exe 46 PID 1752 wrote to memory of 1488 1752 cmd.exe 46 PID 1416 wrote to memory of 1492 1416 wscript.exe 47 PID 1416 wrote to memory of 1492 1416 wscript.exe 47 PID 1416 wrote to memory of 1492 1416 wscript.exe 47 PID 1416 wrote to memory of 1492 1416 wscript.exe 47 PID 1492 wrote to memory of 1640 1492 cmd.exe 49 PID 1492 wrote to memory of 1640 1492 cmd.exe 49 PID 1492 wrote to memory of 1640 1492 cmd.exe 49 PID 1492 wrote to memory of 1640 1492 cmd.exe 49 PID 852 wrote to memory of 1560 852 taskeng.exe 51 PID 852 wrote to memory of 1560 852 taskeng.exe 51 PID 852 wrote to memory of 1560 852 taskeng.exe 51 PID 1720 wrote to memory of 1820 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 53 PID 1720 wrote to memory of 1820 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 53 PID 1720 wrote to memory of 1820 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 53 PID 1720 wrote to memory of 1820 1720 2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe 53 PID 1820 wrote to memory of 1936 1820 cmd.exe 55 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1936 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe"C:\Users\Admin\AppData\Local\Temp\2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe"1⤵
- Matrix Ransomware
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\2e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376.exe" "C:\Users\Admin\AppData\Local\Temp\NWZSnoAf.exe"2⤵PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\NWZSnoAf.exe"C:\Users\Admin\AppData\Local\Temp\NWZSnoAf.exe" -n2⤵
- Executes dropped EXE
PID:900
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\z0FIEB6f.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\xyIMhA14.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\xyIMhA14.bmp" /f3⤵
- Sets desktop wallpaper using registry
PID:1568
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵PID:1544
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵PID:1176
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\LZub1Uvy.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\LZub1Uvy.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\VZ4u44MK.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\VZ4u44MK.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Creates scheduled task(s)
PID:1488
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵PID:1640
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\IjvFcx7d.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""2⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"3⤵
- Views/modifies file attributes
PID:1936
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C3⤵PID:1972
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"3⤵
- Modifies file permissions
PID:272
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c KTNdBnz7.exe -accepteula "AdobeID.pdf" -nobanner3⤵
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\KTNdBnz7.exeKTNdBnz7.exe -accepteula "AdobeID.pdf" -nobanner4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\KTNdBnz764.exeKTNdBnz7.exe -accepteula "AdobeID.pdf" -nobanner5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {931E0FCB-3E5E-4ABF-90ED-7118C379ACEB} S-1-5-21-1214520366-621468234-4062160515-1000:VDWSWJJD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\VZ4u44MK.bat"2⤵PID:1560
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:1252
-
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:644
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1496
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F3⤵PID:848
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
File Deletion
2File and Directory Permissions Modification
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5eb89303f5a8465a54b552fa01c850e77
SHA1ef01517ac20c8a6ad75914de63c28542250c340b
SHA2564bf5982d8a9dee03e4f877183959672ded3ea8f833b168c59d075052d25925c6
SHA5128f493793f991995babfc5a1cbbe9cc3666edab2d686c3163724b26d00f4a2431bd20dbce8e0b5e37711a71097ee0027d83f8b200059571bd01eef609560a0a02
-
Filesize
246B
MD5be2b72f3e29bfada618fdbd79e7f2e23
SHA14fca96440ab242e4571c05c3f4aa3b54552a3086
SHA256e5e8f67dd99ab55dee0ebf8ab0375ecb3d1e9a94874d418ffd79814411dd77e9
SHA512464636531df5d03b76d08b7ec2abd87ed796560256f818bb352aac74cd772661f53a79df5f8e990c83c77001aca4bd0ed8be5fe8f6c57415f48bd0758a2bfa8f
-
Filesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
Filesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
Filesize
221KB
MD53026bc2448763d5a9862d864b97288ff
SHA17d93a18713ece2e7b93e453739ffd7ad0c646e9e
SHA2567adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec
SHA512d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6
-
Filesize
610KB
MD51c73c307773fedfccd544a6b6b0b55b9
SHA1899ffd934e0b8a6df4b115c49df33fca524e2135
SHA2562e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376
SHA512049211f9d07e3cca9f92dfb1bc2e0f6895586f9f36b2651ffb2de20f3573ba9d719aff27e67b996f4706852578e919810e3e6854eebf0aaff0d412d8cabc127d
-
Filesize
610KB
MD51c73c307773fedfccd544a6b6b0b55b9
SHA1899ffd934e0b8a6df4b115c49df33fca524e2135
SHA2562e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376
SHA512049211f9d07e3cca9f92dfb1bc2e0f6895586f9f36b2651ffb2de20f3573ba9d719aff27e67b996f4706852578e919810e3e6854eebf0aaff0d412d8cabc127d
-
Filesize
14B
MD58eb51985066cb0782077f624013d47a2
SHA10549d07d51454e73b937946ba1887cacfce71835
SHA2565537d10911f09132033b185344f75ea1a0ed7e5509b3be00bd8bc93d477baa44
SHA512539a7160bb41366a74d8859b080724f5838132428f672c2bba7ef9c9a259823f15074adec75567bea6724f09d681c04b8763a2f495eff3436ff17420cb7bf0f5
-
Filesize
260B
MD5c8a4922eda2e6ed46de33904bedbfe38
SHA156d09d5dd6512ad70e2cfd22e49dea6fa34c6788
SHA256fb3cae92e12b2a3c78dc5aec0c24dd3dc32cbcf1c92eafeadceeb78f420bb77d
SHA512ccc5ad96fc271d7f4c4ee2609ce5b2f2e1c526a90b676ae4daf706db06649b2fe50a48607ebf2d0a5466ca9ca52d4977a04c66d9e6bfa4ee3ae1b6a49f48d34a
-
Filesize
265B
MD51e8aa6d3a3edcd80d9c35e595554ea9a
SHA112d7cdbfae42f904f345c34ee526ab5d322f4eec
SHA256a2fcaff05363c7bf040a64f2c2110a472704187315d6071b6a923e9eed426254
SHA5121f4cea22fc59c0c0323040210f578a024293643f8320d7d1e89ab84484cf4d13c3fce8105ce4ba79bd6523136c4b4fc86af09bb7db5914a904411d3626f2fb5e
-
Filesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
Filesize
221KB
MD53026bc2448763d5a9862d864b97288ff
SHA17d93a18713ece2e7b93e453739ffd7ad0c646e9e
SHA2567adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec
SHA512d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6
-
Filesize
610KB
MD51c73c307773fedfccd544a6b6b0b55b9
SHA1899ffd934e0b8a6df4b115c49df33fca524e2135
SHA2562e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376
SHA512049211f9d07e3cca9f92dfb1bc2e0f6895586f9f36b2651ffb2de20f3573ba9d719aff27e67b996f4706852578e919810e3e6854eebf0aaff0d412d8cabc127d
-
Filesize
610KB
MD51c73c307773fedfccd544a6b6b0b55b9
SHA1899ffd934e0b8a6df4b115c49df33fca524e2135
SHA2562e4c3ae32372bb1b189665e8e84c13bcc88e7f2c7459f71e075694fd3aaf8376
SHA512049211f9d07e3cca9f92dfb1bc2e0f6895586f9f36b2651ffb2de20f3573ba9d719aff27e67b996f4706852578e919810e3e6854eebf0aaff0d412d8cabc127d