Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20231025-en -
resource tags
arch:x64arch:x86image:win10-20231025-enlocale:en-usos:windows10-1703-x64system -
submitted
30/10/2023, 21:14
Static task
static1
General
-
Target
2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe
-
Size
4.1MB
-
MD5
6cca780b5d78feab6fcf07c4cbc9c52e
-
SHA1
2bbf6645d0a7aaef09ec42742224568a74191f36
-
SHA256
2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3
-
SHA512
25b8e6e3da26f53a3082e3be90ae5c464b7aa48d30a69eb8c0fb40c14c35f1c0947c5d569e8f9077e70af474970984f20fa63f390d36da8b44d61e16a798ecdb
-
SSDEEP
98304:i2wSw+o07xPALnVPII8CJvfhzqAd1MjJxMhYaJ6xFsDFU2KU5ijrveTHTh:CSw+Z9ALVgKfhuEMJSYIasR4wijrvsHV
Malware Config
Signatures
-
Glupteba payload 21 IoCs
resource yara_rule behavioral1/memory/1056-2-0x0000000002F40000-0x000000000382B000-memory.dmp family_glupteba behavioral1/memory/1056-3-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/1056-68-0x0000000002F40000-0x000000000382B000-memory.dmp family_glupteba behavioral1/memory/1056-75-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/1056-79-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/1056-307-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4636-310-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4636-551-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4636-552-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4636-810-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4636-1054-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2092-1057-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2092-1306-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2092-1798-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2092-1812-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2092-1813-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2092-1815-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2092-1817-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2092-1819-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2092-1821-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2092-1830-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1816 netsh.exe -
Executes dropped EXE 5 IoCs
pid Process 2092 csrss.exe 1620 injector.exe 4084 windefender.exe 2168 windefender.exe 3496 f801950a962ddba14caaa44bf084b55c.exe -
resource yara_rule behavioral1/files/0x000700000001abd0-1806.dat upx behavioral1/files/0x000700000001abd0-1808.dat upx behavioral1/files/0x000700000001abd0-1809.dat upx behavioral1/memory/4084-1811-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2168-1814-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2168-1818-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/files/0x000600000001abd1-1826.dat upx behavioral1/files/0x000600000001abd1-1827.dat upx behavioral1/memory/2168-1829-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3496-1832-0x0000000000400000-0x0000000000C25000-memory.dmp upx behavioral1/memory/3496-1834-0x0000000000400000-0x0000000000C25000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe = "0" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2852493121-870915337-2715324265-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2852493121-870915337-2715324265-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe File created C:\Windows\rss\csrss.exe 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 768 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4888 schtasks.exe 1108 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4828 powershell.exe 4828 powershell.exe 4828 powershell.exe 1056 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 1056 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 4884 powershell.exe 4884 powershell.exe 4884 powershell.exe 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 3608 powershell.exe 3608 powershell.exe 3608 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 1012 powershell.exe 1012 powershell.exe 1012 powershell.exe 3788 powershell.exe 3788 powershell.exe 3788 powershell.exe 4480 powershell.exe 4480 powershell.exe 4480 powershell.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 2092 csrss.exe 2092 csrss.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 2092 csrss.exe 2092 csrss.exe 2092 csrss.exe 2092 csrss.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe 1620 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 4828 powershell.exe Token: SeDebugPrivilege 1056 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Token: SeImpersonatePrivilege 1056 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe Token: SeDebugPrivilege 4884 powershell.exe Token: SeDebugPrivilege 3608 powershell.exe Token: SeDebugPrivilege 2044 powershell.exe Token: SeDebugPrivilege 1012 powershell.exe Token: SeDebugPrivilege 3788 powershell.exe Token: SeDebugPrivilege 4480 powershell.exe Token: SeSystemEnvironmentPrivilege 2092 csrss.exe Token: SeSecurityPrivilege 768 sc.exe Token: SeSecurityPrivilege 768 sc.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1056 wrote to memory of 4828 1056 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 72 PID 1056 wrote to memory of 4828 1056 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 72 PID 1056 wrote to memory of 4828 1056 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 72 PID 4636 wrote to memory of 4884 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 77 PID 4636 wrote to memory of 4884 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 77 PID 4636 wrote to memory of 4884 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 77 PID 4636 wrote to memory of 1212 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 79 PID 4636 wrote to memory of 1212 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 79 PID 1212 wrote to memory of 1816 1212 cmd.exe 81 PID 1212 wrote to memory of 1816 1212 cmd.exe 81 PID 4636 wrote to memory of 3608 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 82 PID 4636 wrote to memory of 3608 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 82 PID 4636 wrote to memory of 3608 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 82 PID 4636 wrote to memory of 2044 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 84 PID 4636 wrote to memory of 2044 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 84 PID 4636 wrote to memory of 2044 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 84 PID 4636 wrote to memory of 2092 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 86 PID 4636 wrote to memory of 2092 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 86 PID 4636 wrote to memory of 2092 4636 2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe 86 PID 2092 wrote to memory of 1012 2092 csrss.exe 87 PID 2092 wrote to memory of 1012 2092 csrss.exe 87 PID 2092 wrote to memory of 1012 2092 csrss.exe 87 PID 2092 wrote to memory of 3788 2092 csrss.exe 94 PID 2092 wrote to memory of 3788 2092 csrss.exe 94 PID 2092 wrote to memory of 3788 2092 csrss.exe 94 PID 2092 wrote to memory of 4480 2092 csrss.exe 96 PID 2092 wrote to memory of 4480 2092 csrss.exe 96 PID 2092 wrote to memory of 4480 2092 csrss.exe 96 PID 2092 wrote to memory of 1620 2092 csrss.exe 98 PID 2092 wrote to memory of 1620 2092 csrss.exe 98 PID 4084 wrote to memory of 1324 4084 windefender.exe 105 PID 4084 wrote to memory of 1324 4084 windefender.exe 105 PID 4084 wrote to memory of 1324 4084 windefender.exe 105 PID 1324 wrote to memory of 768 1324 cmd.exe 106 PID 1324 wrote to memory of 768 1324 cmd.exe 106 PID 1324 wrote to memory of 768 1324 cmd.exe 106 PID 2092 wrote to memory of 3496 2092 csrss.exe 109 PID 2092 wrote to memory of 3496 2092 csrss.exe 109 PID 2092 wrote to memory of 3496 2092 csrss.exe 109 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe"C:\Users\Admin\AppData\Local\Temp\2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
-
C:\Users\Admin\AppData\Local\Temp\2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe"C:\Users\Admin\AppData\Local\Temp\2cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:1816
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3608
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4888
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3960
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3788
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1620
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1108
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:768
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe4⤵
- Executes dropped EXE
PID:3496 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "csrss" /f5⤵PID:1436
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "ScheduledUpdate" /f5⤵PID:4476
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2168
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
Filesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
Filesize
99KB
MD509031a062610d77d685c9934318b4170
SHA1880f744184e7774f3d14c1bb857e21cc7fe89a6d
SHA256778bd69af403df3c4e074c31b3850d71bf0e64524bea4272a802ca9520b379dd
SHA5129a276e1f0f55d35f2bf38eb093464f7065bdd30a660e6d1c62eed5e76d1fb2201567b89d9ae65d2d89dc99b142159e36fb73be8d5e08252a975d50544a7cda27
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5aca01617c7300fb388edf273984b5d20
SHA14a9b9b24d64619724a1c7dbb462286ee79156d5f
SHA25629685a6da2fc1b2866d407ed8b39c83e777d0862a880568681ebe6de90625e69
SHA5127798bebf54300da210f944484822f50bdcf2a10a84d6703dade1e8bc89a7b20942d110a9ff52ff29471a97f9005528b1ba63991544948b2bb5921f06100196a4
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD52ae69035fa1e9964b84cdcc3a0485068
SHA13fd463d1431843ff6ac6543ac81e96d9fa34ca0f
SHA256285a36833a738c3416298fd45164a6fb73cdbb3bfb1bb478734b2d67f22056de
SHA5123d29d6f62f45db187d0842b1209c16856d74b498f9d0a2e9ebe4578008e1da2b47c6786c0b32c612e598a5b06527b4a0c33543ca0b34e112a1fbf1000dfbb669
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD537461eb76fa6546c8a8f987109bd9786
SHA189fe2fc256441223c3aed85cb752b05294d01dfe
SHA256562d4fb30bfcc4fc358d86098b501e2cecfebae068e60605cf1d486b72024ff8
SHA51209478e47c2a0522f135c2b0020cae808ca55de0a9a2085066ba94affabec8303096adc615ba06ee1560cbf021e5af940e3158bb21d1d3586d47f4c33b479b930
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5567e3ff4e2ea040e95ce03a0372aeac6
SHA194fbaf1ae30d114cab84078e08cc586b55e3c89f
SHA2568417b84abded02f5a724a64aabef3073456fb0da434ce56fbaeca5fdaf41816d
SHA512cbad66d40336f26d523521d41675e94dae732f159418f415817e7d90607f31a98ec81171853d929f23970ef07d805122d9191a2f46d47e54a713c061de91805c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5229069b82c090917dab1d17c6ed73789
SHA1a9aa1eb21fe063b793b46a5ca7d1790991cb4702
SHA2564ae5532b73fc6aed0cc71f2bddf318ec338f017c79af1aa6f31daf32fcceca20
SHA512170d2e2c3a01f51277db1c90bc6e2193fdbb80261369d7e6eaa5a7f2a96cd641be6daa8450d0a33143e75440f0ea3951fcc4488d357b0816610b8ad2c7f48f05
-
Filesize
4.1MB
MD56cca780b5d78feab6fcf07c4cbc9c52e
SHA12bbf6645d0a7aaef09ec42742224568a74191f36
SHA2562cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3
SHA51225b8e6e3da26f53a3082e3be90ae5c464b7aa48d30a69eb8c0fb40c14c35f1c0947c5d569e8f9077e70af474970984f20fa63f390d36da8b44d61e16a798ecdb
-
Filesize
4.1MB
MD56cca780b5d78feab6fcf07c4cbc9c52e
SHA12bbf6645d0a7aaef09ec42742224568a74191f36
SHA2562cd5757ed7dc5c222092573bcacb790a298525ebd71241164b516a7af828ffb3
SHA51225b8e6e3da26f53a3082e3be90ae5c464b7aa48d30a69eb8c0fb40c14c35f1c0947c5d569e8f9077e70af474970984f20fa63f390d36da8b44d61e16a798ecdb
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec