Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
05/11/2023, 06:31
Static task
static1
Behavioral task
behavioral1
Sample
Citric Installer.msi
Resource
win7-20231023-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Citric Installer.msi
Resource
win10v2004-20231020-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Citric Installer.msi
-
Size
9.1MB
-
MD5
1ffd85bb7326be4ca11fa950f9f6e65e
-
SHA1
9c0cd827d9c8930beece29b9741a79d3a43ee053
-
SHA256
09c61a5f060f45a4fd5e7c2d4b3c5a6ffae4c21d83cb0d4d84858944cdf40c7b
-
SHA512
7102ee1dbd1fdb793eab9c12c0758353d25df7f7d206f62d69f07531f2cd6f52ac7210b2f883c77fbf9b57fac04b57b78d3c479a5fcb4ba3fff7d1a386f76bec
-
SSDEEP
196608:tLGsJhHv8xDMMv00DomHHuiObiKcUR6j9r6AI242:5Gchh58oUuT+UCwA
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1744 Citric Composer.exe -
Loads dropped DLL 7 IoCs
pid Process 3044 MsiExec.exe 3044 MsiExec.exe 584 MsiExec.exe 584 MsiExec.exe 1744 Citric Composer.exe 1744 Citric Composer.exe 1744 Citric Composer.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Drops file in Program Files directory 27 IoCs
description ioc Process File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Image\button\pause.png msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Icon\updaterIcon.ico msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Image\button\stop.png msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Icon\strm.ico msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\ScintillaNET.dll msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Icon\sseq.ico msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Icon\recordArc.ico msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Citric Composer.exe.config msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Citric Composer.exe msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Icon\icon.ico msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Image\play4.png msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Icon\isabelle.ico msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Image\button\play4.png msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Crc32.dll msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Icon\group.ico msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Citric Updater.exe msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Icon\waveArchive.ico msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Image\button\play.png msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\SequenceDataLib.exe msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Image\button\play2.png msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Icon\wave.ico msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Icon\seqArc.ico msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Citric Updater.exe.config msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Icon\lookup.ico msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Image\pause.png msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Icon\bank.ico msiexec.exe File created C:\Program Files (x86)\Gota7\Citric Composer\Data\Image\button\play3.png msiexec.exe -
Drops file in Windows directory 42 IoCs
description ioc Process File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_75065DA43F1CA82E70EB19.exe msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_7FCBC0B0B0DC6E6433401F.exe msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_3F6770AD9FA9846D6CD0B4.exe msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIC449.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC534.tmp msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_A59CFF6D02F7407D036E36.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIC7C4.tmp msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_853F67D554F05449430E7E.exe msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_112D608FD02CD87FDC7735.exe msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_7DF52CF276838B1F5490BD.exe msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_FF5F7EE46A7BDA9904539A.exe msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_AF6A3F376A05B7CA408B0C.exe msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_93EDBD9DCCFD6F69DE10C6.exe msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_107AD139FD77177BB6D094.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f76c34f.msi msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_0BF88D873BB9D8FE5A7D6C.exe msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_112D608FD02CD87FDC7735.exe msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_7DF52CF276838B1F5490BD.exe msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_FF5F7EE46A7BDA9904539A.exe msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_AF6A3F376A05B7CA408B0C.exe msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_4123484A2DA35FC16997E0.exe msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_2104367FB70FF3B5EE2E0C.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f76c350.ipi msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_2104367FB70FF3B5EE2E0C.exe msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_0BF88D873BB9D8FE5A7D6C.exe msiexec.exe File created C:\Windows\Installer\f76c352.msi msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_F629BB280EF5C6DB94ABCF.exe msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_107AD139FD77177BB6D094.exe msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_7FCBC0B0B0DC6E6433401F.exe msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_93EDBD9DCCFD6F69DE10C6.exe msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_3F6770AD9FA9846D6CD0B4.exe msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_A59CFF6D02F7407D036E36.exe msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_4123484A2DA35FC16997E0.exe msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_853F67D554F05449430E7E.exe msiexec.exe File created C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_F629BB280EF5C6DB94ABCF.exe msiexec.exe File opened for modification C:\Windows\Installer\{E570723A-A79A-4106-A591-6979938CA824}\_75065DA43F1CA82E70EB19.exe msiexec.exe File opened for modification C:\Windows\Installer\f76c350.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f76c34f.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bcsar\ = "Sound Archive" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bcwsd msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wave Archive\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Isabelle Sound Project\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bfseq\ = "Sequence" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bcstm\ = "Stream" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|Gota7|Citric Composer|Crc32.dll\Crc32,Version="1.1.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 260039002500680072005d0039004d007500380042004b00710024004f006b0062004f006b002e003e00520067006c00510057002d0051004800550074005100450050003d0060007e00420065007d00680000000000 msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" Citric Composer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bfwav msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sequence\shell\open\ = "&Open" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Group\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bfstm\ = "Stream" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bcstm\Stream msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Isabelle Sound Project\shell msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|Gota7|Citric Composer|SequenceDataLib.exe\SequenceDataLib,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 260039002500680072005d0039004d007500380042004b00710024004f006b0062004f006b002e003e006e0056007e004b0075002e007e00640028002a006e004b004600740064006600590049004c00340000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Bank\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A327075EA97A60145A19969739C88A42\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bfgrp\ = "Group" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bcgrp msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bcgrp\ = "Group" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bwav\Binary Wave\ShellNew msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Isabelle Sound Project\shell\open\ = "&Open" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sound Archive\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stream\DefaultIcon\ = "C:\\Windows\\Installer\\{E570723A-A79A-4106-A591-6979938CA824}\\_4123484A2DA35FC16997E0.exe,0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|Gota7|Citric Composer|Citric Updater.exe\Citric Updater,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 260039002500680072005d0039004d007500380042004b00710024004f006b0062004f006b002e003e0035007e003800570045002a00470049004d0028004600260032003800250031007e005f002c00640000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg Citric Composer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" Citric Composer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bcgrp\Group\ShellNew msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bcstm msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Group\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Binary Wave\ = "Binary Wave" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\12AB4488055AB4845AC7CBCFC975A692\A327075EA97A60145A19969739C88A42 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Citric Composer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" Citric Composer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Stream\shell\open\command\command = 260039002500680072005d0039004d007500380042004b00710024004f006b0062004f006b002e003e0046007a0021007e0069003900600068005e0053005200350038003100720043004d007300620045002000220025003100220000000000 msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Citric Composer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Citric Composer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bcseq msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Group\DefaultIcon\ = "C:\\Windows\\Installer\\{E570723A-A79A-4106-A591-6979938CA824}\\_7DF52CF276838B1F5490BD.exe,0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stream\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|Gota7|Citric Composer|ScintillaNET.dll msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A327075EA97A60145A19969739C88A42\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bfseq msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A327075EA97A60145A19969739C88A42\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Citric Composer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Citric Composer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bfwsd\Wave Sound Data msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bcgrp\Group msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bcstp msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Isabelle Sound Project\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Isabelle Sound Project\shell\ = "open" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sequence\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Group\ = "Group" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Bank\DefaultIcon\ = "C:\\Windows\\Installer\\{E570723A-A79A-4106-A591-6979938CA824}\\_7FCBC0B0B0DC6E6433401F.exe,0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} Citric Composer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Prefetch\shell\ = "open" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Binary Wave\shell\open\command\command = 260039002500680072005d0039004d007500380042004b00710024004f006b0062004f006b002e003e0046007a0021007e0069003900600068005e0053005200350038003100720043004d007300620045002000220025003100220000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wave\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bfwav\ = "Wave" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cisp msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wave\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wave Sound Data msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wave Sound Data\shell\ = "open" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bcwar\Wave Archive msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2196 msiexec.exe 2196 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1744 Citric Composer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 536 msiexec.exe Token: SeIncreaseQuotaPrivilege 536 msiexec.exe Token: SeRestorePrivilege 2196 msiexec.exe Token: SeTakeOwnershipPrivilege 2196 msiexec.exe Token: SeSecurityPrivilege 2196 msiexec.exe Token: SeCreateTokenPrivilege 536 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 536 msiexec.exe Token: SeLockMemoryPrivilege 536 msiexec.exe Token: SeIncreaseQuotaPrivilege 536 msiexec.exe Token: SeMachineAccountPrivilege 536 msiexec.exe Token: SeTcbPrivilege 536 msiexec.exe Token: SeSecurityPrivilege 536 msiexec.exe Token: SeTakeOwnershipPrivilege 536 msiexec.exe Token: SeLoadDriverPrivilege 536 msiexec.exe Token: SeSystemProfilePrivilege 536 msiexec.exe Token: SeSystemtimePrivilege 536 msiexec.exe Token: SeProfSingleProcessPrivilege 536 msiexec.exe Token: SeIncBasePriorityPrivilege 536 msiexec.exe Token: SeCreatePagefilePrivilege 536 msiexec.exe Token: SeCreatePermanentPrivilege 536 msiexec.exe Token: SeBackupPrivilege 536 msiexec.exe Token: SeRestorePrivilege 536 msiexec.exe Token: SeShutdownPrivilege 536 msiexec.exe Token: SeDebugPrivilege 536 msiexec.exe Token: SeAuditPrivilege 536 msiexec.exe Token: SeSystemEnvironmentPrivilege 536 msiexec.exe Token: SeChangeNotifyPrivilege 536 msiexec.exe Token: SeRemoteShutdownPrivilege 536 msiexec.exe Token: SeUndockPrivilege 536 msiexec.exe Token: SeSyncAgentPrivilege 536 msiexec.exe Token: SeEnableDelegationPrivilege 536 msiexec.exe Token: SeManageVolumePrivilege 536 msiexec.exe Token: SeImpersonatePrivilege 536 msiexec.exe Token: SeCreateGlobalPrivilege 536 msiexec.exe Token: SeCreateTokenPrivilege 536 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 536 msiexec.exe Token: SeLockMemoryPrivilege 536 msiexec.exe Token: SeIncreaseQuotaPrivilege 536 msiexec.exe Token: SeMachineAccountPrivilege 536 msiexec.exe Token: SeTcbPrivilege 536 msiexec.exe Token: SeSecurityPrivilege 536 msiexec.exe Token: SeTakeOwnershipPrivilege 536 msiexec.exe Token: SeLoadDriverPrivilege 536 msiexec.exe Token: SeSystemProfilePrivilege 536 msiexec.exe Token: SeSystemtimePrivilege 536 msiexec.exe Token: SeProfSingleProcessPrivilege 536 msiexec.exe Token: SeIncBasePriorityPrivilege 536 msiexec.exe Token: SeCreatePagefilePrivilege 536 msiexec.exe Token: SeCreatePermanentPrivilege 536 msiexec.exe Token: SeBackupPrivilege 536 msiexec.exe Token: SeRestorePrivilege 536 msiexec.exe Token: SeShutdownPrivilege 536 msiexec.exe Token: SeDebugPrivilege 536 msiexec.exe Token: SeAuditPrivilege 536 msiexec.exe Token: SeSystemEnvironmentPrivilege 536 msiexec.exe Token: SeChangeNotifyPrivilege 536 msiexec.exe Token: SeRemoteShutdownPrivilege 536 msiexec.exe Token: SeUndockPrivilege 536 msiexec.exe Token: SeSyncAgentPrivilege 536 msiexec.exe Token: SeEnableDelegationPrivilege 536 msiexec.exe Token: SeManageVolumePrivilege 536 msiexec.exe Token: SeImpersonatePrivilege 536 msiexec.exe Token: SeCreateGlobalPrivilege 536 msiexec.exe Token: SeCreateTokenPrivilege 536 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 536 msiexec.exe 536 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1744 Citric Composer.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2196 wrote to memory of 3044 2196 msiexec.exe 29 PID 2196 wrote to memory of 3044 2196 msiexec.exe 29 PID 2196 wrote to memory of 3044 2196 msiexec.exe 29 PID 2196 wrote to memory of 3044 2196 msiexec.exe 29 PID 2196 wrote to memory of 3044 2196 msiexec.exe 29 PID 2196 wrote to memory of 3044 2196 msiexec.exe 29 PID 2196 wrote to memory of 3044 2196 msiexec.exe 29 PID 2196 wrote to memory of 584 2196 msiexec.exe 33 PID 2196 wrote to memory of 584 2196 msiexec.exe 33 PID 2196 wrote to memory of 584 2196 msiexec.exe 33 PID 2196 wrote to memory of 584 2196 msiexec.exe 33 PID 2196 wrote to memory of 584 2196 msiexec.exe 33 PID 2196 wrote to memory of 584 2196 msiexec.exe 33 PID 2196 wrote to memory of 584 2196 msiexec.exe 33 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Citric Installer.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:536
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 99D0CF4E8E71F42EA746003CFCA4517B C2⤵
- Loads dropped DLL
PID:3044
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B1D7D9B2A3DCBAB6A524317AE1D656B62⤵
- Loads dropped DLL
PID:584
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2632
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000300" "00000000000003D8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2552
-
C:\Program Files (x86)\Gota7\Citric Composer\Citric Composer.exe"C:\Program Files (x86)\Gota7\Citric Composer\Citric Composer.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD50b5cb09b5d8868f66cb7a8e5a02256af
SHA1da9148e0e28a48b773c11b0e6b3eb52f6e393d9c
SHA25679e6619d630822182c8db53227bd30a869953fd1527b7365b3a466134e35e909
SHA51206ef6f74ae232565d8a4a85b30a03946d1d7a4baad60a120242e636bd0626abd0df22a8d395df2b608980cdb504f04cdbe877d6b7fcf928eaff84921b64f1aef
-
Filesize
8.5MB
MD52bcc7f6dc8df6b201fbefeab92afb401
SHA1195b622a95a8abb7244f5635f570f8b450e3efbf
SHA25658d68f2c32d7c488219aa1d23da6f523f0f21c2fd67a6836173406bb5ca2a0f0
SHA512db62ebb2fdb95c0134ba38dbc628a65fd0c67a078fcbe3be2e5c2f4633b581d7888ce62a961fb485325f4946dfd6ec4b8814a50485cbb38f09f4d662f17c1d7b
-
Filesize
8.5MB
MD52bcc7f6dc8df6b201fbefeab92afb401
SHA1195b622a95a8abb7244f5635f570f8b450e3efbf
SHA25658d68f2c32d7c488219aa1d23da6f523f0f21c2fd67a6836173406bb5ca2a0f0
SHA512db62ebb2fdb95c0134ba38dbc628a65fd0c67a078fcbe3be2e5c2f4633b581d7888ce62a961fb485325f4946dfd6ec4b8814a50485cbb38f09f4d662f17c1d7b
-
Filesize
184B
MD552639fb99722ea7b6cb91acb33ea3ff0
SHA1b7b3b0da0676efe42a9bbf402aa22f6f780c8394
SHA256c0d7aeba3b28ab01bca0428d05e1d1c83c655cf7949a3179d27ad80554e33c03
SHA512114f1e8deec01a6487658d6a3f448730c970f9fcca10c04c40192535f2349a29d0f09069b2d6600d8d0f1b5dd5f836c9c7c0d72e05801ac4979b051eb1d1a7e1
-
Filesize
1.3MB
MD59166536c31f4e725e6befe85e2889a4b
SHA1f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae
SHA256ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163
SHA512113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562
-
Filesize
301KB
MD548941bf44e6b3e17c15b05edd0e3191d
SHA1fb1e586d7aa2e2faabe35eaa37c61d4941900f2d
SHA25634cab9b8388ffdbcc14d61ecb81bc2044eefffbc9db0728e986278b343502f2b
SHA51204b06239e1deea0af4c54f496e7f577b25d986f7dd476ed7648a2d0b723ad319e6c3c16ce4de52a977c63747e7fae2fd06e7c5fd044d1b258f196bd9caeb7b4c
-
Filesize
301KB
MD548941bf44e6b3e17c15b05edd0e3191d
SHA1fb1e586d7aa2e2faabe35eaa37c61d4941900f2d
SHA25634cab9b8388ffdbcc14d61ecb81bc2044eefffbc9db0728e986278b343502f2b
SHA51204b06239e1deea0af4c54f496e7f577b25d986f7dd476ed7648a2d0b723ad319e6c3c16ce4de52a977c63747e7fae2fd06e7c5fd044d1b258f196bd9caeb7b4c
-
Filesize
301KB
MD548941bf44e6b3e17c15b05edd0e3191d
SHA1fb1e586d7aa2e2faabe35eaa37c61d4941900f2d
SHA25634cab9b8388ffdbcc14d61ecb81bc2044eefffbc9db0728e986278b343502f2b
SHA51204b06239e1deea0af4c54f496e7f577b25d986f7dd476ed7648a2d0b723ad319e6c3c16ce4de52a977c63747e7fae2fd06e7c5fd044d1b258f196bd9caeb7b4c
-
Filesize
301KB
MD548941bf44e6b3e17c15b05edd0e3191d
SHA1fb1e586d7aa2e2faabe35eaa37c61d4941900f2d
SHA25634cab9b8388ffdbcc14d61ecb81bc2044eefffbc9db0728e986278b343502f2b
SHA51204b06239e1deea0af4c54f496e7f577b25d986f7dd476ed7648a2d0b723ad319e6c3c16ce4de52a977c63747e7fae2fd06e7c5fd044d1b258f196bd9caeb7b4c
-
Filesize
301KB
MD548941bf44e6b3e17c15b05edd0e3191d
SHA1fb1e586d7aa2e2faabe35eaa37c61d4941900f2d
SHA25634cab9b8388ffdbcc14d61ecb81bc2044eefffbc9db0728e986278b343502f2b
SHA51204b06239e1deea0af4c54f496e7f577b25d986f7dd476ed7648a2d0b723ad319e6c3c16ce4de52a977c63747e7fae2fd06e7c5fd044d1b258f196bd9caeb7b4c
-
Filesize
9.1MB
MD51ffd85bb7326be4ca11fa950f9f6e65e
SHA19c0cd827d9c8930beece29b9741a79d3a43ee053
SHA25609c61a5f060f45a4fd5e7c2d4b3c5a6ffae4c21d83cb0d4d84858944cdf40c7b
SHA5127102ee1dbd1fdb793eab9c12c0758353d25df7f7d206f62d69f07531f2cd6f52ac7210b2f883c77fbf9b57fac04b57b78d3c479a5fcb4ba3fff7d1a386f76bec
-
Filesize
123KB
MD53ca522457fa9c110262f5d2674d5d2cf
SHA11c3a308ba7b1f4635728c58165965bc3875b6d7e
SHA2561b8d00826f23749ac20a46a24d59bcbe3ff5414098c82be9844422df51418b64
SHA512a0991716ec895bc53b857d5ce0c75d39632a4fe6b5ace98c0e243527912686c9ddda50a0dfab13c687e87ebfc66495e358cbbd63f724fce602e324e5ff261c55
-
Filesize
1KB
MD52bb8ba822c4bac82508952bd26f1e4c7
SHA1db7e78f6d2d82a456049d9e93588ad1e5d07c0cb
SHA256df61f578dbdad018e4fef49b6299c02031fafc2fbf1f46ef0aae02401d477fcc
SHA51268cc2e0e2dd54d7d4e812b3b90672f38a8383734ea801c0501bfb9088940d0d00259c74ce90edb467af42ceb693c7cb76d8ac4f8f934193977a62eea97ab3d3b
-
Filesize
1.3MB
MD59166536c31f4e725e6befe85e2889a4b
SHA1f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae
SHA256ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163
SHA512113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562
-
Filesize
1.3MB
MD59166536c31f4e725e6befe85e2889a4b
SHA1f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae
SHA256ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163
SHA512113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562
-
Filesize
301KB
MD548941bf44e6b3e17c15b05edd0e3191d
SHA1fb1e586d7aa2e2faabe35eaa37c61d4941900f2d
SHA25634cab9b8388ffdbcc14d61ecb81bc2044eefffbc9db0728e986278b343502f2b
SHA51204b06239e1deea0af4c54f496e7f577b25d986f7dd476ed7648a2d0b723ad319e6c3c16ce4de52a977c63747e7fae2fd06e7c5fd044d1b258f196bd9caeb7b4c
-
Filesize
301KB
MD548941bf44e6b3e17c15b05edd0e3191d
SHA1fb1e586d7aa2e2faabe35eaa37c61d4941900f2d
SHA25634cab9b8388ffdbcc14d61ecb81bc2044eefffbc9db0728e986278b343502f2b
SHA51204b06239e1deea0af4c54f496e7f577b25d986f7dd476ed7648a2d0b723ad319e6c3c16ce4de52a977c63747e7fae2fd06e7c5fd044d1b258f196bd9caeb7b4c
-
Filesize
943KB
MD52ff7acfa80647ee46cc3c0e446327108
SHA1c994820d03af722c244b046d1ee0967f1b5bc478
SHA25608f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d
SHA51250a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd
-
Filesize
301KB
MD548941bf44e6b3e17c15b05edd0e3191d
SHA1fb1e586d7aa2e2faabe35eaa37c61d4941900f2d
SHA25634cab9b8388ffdbcc14d61ecb81bc2044eefffbc9db0728e986278b343502f2b
SHA51204b06239e1deea0af4c54f496e7f577b25d986f7dd476ed7648a2d0b723ad319e6c3c16ce4de52a977c63747e7fae2fd06e7c5fd044d1b258f196bd9caeb7b4c
-
Filesize
301KB
MD548941bf44e6b3e17c15b05edd0e3191d
SHA1fb1e586d7aa2e2faabe35eaa37c61d4941900f2d
SHA25634cab9b8388ffdbcc14d61ecb81bc2044eefffbc9db0728e986278b343502f2b
SHA51204b06239e1deea0af4c54f496e7f577b25d986f7dd476ed7648a2d0b723ad319e6c3c16ce4de52a977c63747e7fae2fd06e7c5fd044d1b258f196bd9caeb7b4c