Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2023 10:29
Static task
static1
Behavioral task
behavioral1
Sample
a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe
Resource
win10v2004-20231020-en
General
-
Target
a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe
-
Size
251KB
-
MD5
0a603a16ff9136c693c009e29023422a
-
SHA1
22c858d81e972eefeb917ce9a227a3b6276ce140
-
SHA256
a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3
-
SHA512
ec7d036ce78113fca01a9c2b4e37c33b137cc04a4086eccf534447ee709f06db9dc42fcb1aee4066bfdb3ed2c88a7959cd8c8bb0602979298a4821cbd02fe47a
-
SSDEEP
3072:AtCrzYS4GBMBTMTHr7BZPvPLMg17/avcRmotnFcjC5RecAk:qqEskTMTLFtPLMg5/aEmobc+q
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Extracted
redline
LogsDiller Cloud (Bot: @logsdillabot)
194.49.94.181:40264
Extracted
amadey
4.12
http://185.172.128.19
-
install_dir
cd1f156d67
-
install_file
Utsysc.exe
-
strings_key
0dd3e5ee91b367c60c9e575983554b30
-
url_paths
/ghsdh39s/index.php
Extracted
djvu
http://zexeq.com/lancer/get.php
-
extension
.gycc
-
offline_id
nN1rRlTxKTPo66pmJEAHwufZ2Dhz4MsNxIlOk6t1
-
payload_url
http://brusuax.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-CDZ4hMgp2X Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0829ASdw
Signatures
-
Detected Djvu ransomware 7 IoCs
Processes:
resource yara_rule behavioral2/memory/1104-189-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1104-187-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1104-192-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1104-226-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3928-252-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3928-253-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3928-255-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Glupteba payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/5084-229-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/5084-286-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/5084-299-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1824-321-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1824-371-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1548-116-0x0000000000400000-0x000000000043C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
3E5.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3E5.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
3E5.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3E5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3E5.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1D0E.exe2770.exeFD1D.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation 1D0E.exe Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation 2770.exe Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation FD1D.exe -
Deletes itself 1 IoCs
Processes:
pid process 3352 -
Executes dropped EXE 20 IoCs
Processes:
FD1D.exe3E5.exe6D4.exe1220.exe1D0E.exe2348.exe288c47bbc1871b439df19ff4df68f076.exe2770.exeInstallSetup8.exeBroom.exeFD1D.exeFD1D.exeFD1D.exe288c47bbc1871b439df19ff4df68f076.exe2770.execsrss.exeinjector.exewindefender.exewindefender.exe2770.exepid process 400 FD1D.exe 1896 3E5.exe 3528 6D4.exe 4916 1220.exe 4328 1D0E.exe 4360 2348.exe 5084 288c47bbc1871b439df19ff4df68f076.exe 3348 2770.exe 4244 InstallSetup8.exe 1632 Broom.exe 1104 FD1D.exe 2256 FD1D.exe 3928 FD1D.exe 1824 288c47bbc1871b439df19ff4df68f076.exe 3448 2770.exe 1972 csrss.exe 1836 injector.exe 1740 windefender.exe 4972 windefender.exe 2112 2770.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 2784 regsvr32.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3E5.exe themida C:\Users\Admin\AppData\Local\Temp\3E5.exe themida behavioral2/memory/1896-81-0x0000000000700000-0x0000000000F32000-memory.dmp themida -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
FD1D.exe288c47bbc1871b439df19ff4df68f076.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\e4ecd1e9-f8b8-4619-a13d-bfe597d5fd6e\\FD1D.exe\" --AutoStart" FD1D.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
3E5.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3E5.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 62 api.2ip.ua 63 api.2ip.ua -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
3E5.exepid process 1896 3E5.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
6D4.exeFD1D.exeFD1D.exe2348.exeAddInProcess32.exedescription pid process target process PID 3528 set thread context of 1548 3528 6D4.exe AppLaunch.exe PID 400 set thread context of 1104 400 FD1D.exe FD1D.exe PID 2256 set thread context of 3928 2256 FD1D.exe FD1D.exe PID 4360 set thread context of 2204 4360 2348.exe AddInProcess32.exe PID 4360 set thread context of 3836 4360 2348.exe AddInProcess32.exe PID 2204 set thread context of 2964 2204 AddInProcess32.exe InstallUtil.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
288c47bbc1871b439df19ff4df68f076.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 288c47bbc1871b439df19ff4df68f076.exe -
Drops file in Windows directory 4 IoCs
Processes:
288c47bbc1871b439df19ff4df68f076.execsrss.exedescription ioc process File opened for modification C:\Windows\rss 288c47bbc1871b439df19ff4df68f076.exe File created C:\Windows\rss\csrss.exe 288c47bbc1871b439df19ff4df68f076.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4032 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3368 3928 WerFault.exe FD1D.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe1220.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1220.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1220.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1220.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 220 schtasks.exe 1756 schtasks.exe 2308 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
288c47bbc1871b439df19ff4df68f076.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exepid process 4712 a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe 4712 a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 3352 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3352 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe1220.exepid process 4712 a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe 3352 3352 3352 3352 4916 1220.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2348.exe3E5.exeAppLaunch.exepowershell.exe288c47bbc1871b439df19ff4df68f076.exepowershell.exepowershell.exepowershell.exeAddInProcess32.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeDebugPrivilege 4360 2348.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeDebugPrivilege 1896 3E5.exe Token: SeDebugPrivilege 1548 AppLaunch.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeDebugPrivilege 1164 powershell.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeDebugPrivilege 5084 288c47bbc1871b439df19ff4df68f076.exe Token: SeImpersonatePrivilege 5084 288c47bbc1871b439df19ff4df68f076.exe Token: SeDebugPrivilege 1476 powershell.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeDebugPrivilege 3932 powershell.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeDebugPrivilege 4860 powershell.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeDebugPrivilege 2204 AddInProcess32.exe Token: SeDebugPrivilege 2660 powershell.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeDebugPrivilege 2780 powershell.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeDebugPrivilege 4992 powershell.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeSystemEnvironmentPrivilege 1972 csrss.exe Token: SeSecurityPrivilege 4032 sc.exe Token: SeSecurityPrivilege 4032 sc.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Broom.exepid process 1632 Broom.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3352 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exe1D0E.exe6D4.exeInstallSetup8.exe2770.exeFD1D.exeFD1D.exedescription pid process target process PID 3352 wrote to memory of 400 3352 FD1D.exe PID 3352 wrote to memory of 400 3352 FD1D.exe PID 3352 wrote to memory of 400 3352 FD1D.exe PID 3352 wrote to memory of 452 3352 regsvr32.exe PID 3352 wrote to memory of 452 3352 regsvr32.exe PID 452 wrote to memory of 2784 452 regsvr32.exe regsvr32.exe PID 452 wrote to memory of 2784 452 regsvr32.exe regsvr32.exe PID 452 wrote to memory of 2784 452 regsvr32.exe regsvr32.exe PID 3352 wrote to memory of 1896 3352 3E5.exe PID 3352 wrote to memory of 1896 3352 3E5.exe PID 3352 wrote to memory of 1896 3352 3E5.exe PID 3352 wrote to memory of 3528 3352 6D4.exe PID 3352 wrote to memory of 3528 3352 6D4.exe PID 3352 wrote to memory of 3528 3352 6D4.exe PID 3352 wrote to memory of 4916 3352 1220.exe PID 3352 wrote to memory of 4916 3352 1220.exe PID 3352 wrote to memory of 4916 3352 1220.exe PID 3352 wrote to memory of 4328 3352 1D0E.exe PID 3352 wrote to memory of 4328 3352 1D0E.exe PID 3352 wrote to memory of 4328 3352 1D0E.exe PID 3352 wrote to memory of 4360 3352 2348.exe PID 3352 wrote to memory of 4360 3352 2348.exe PID 3352 wrote to memory of 4360 3352 2348.exe PID 4328 wrote to memory of 5084 4328 1D0E.exe 288c47bbc1871b439df19ff4df68f076.exe PID 4328 wrote to memory of 5084 4328 1D0E.exe 288c47bbc1871b439df19ff4df68f076.exe PID 4328 wrote to memory of 5084 4328 1D0E.exe 288c47bbc1871b439df19ff4df68f076.exe PID 3528 wrote to memory of 1548 3528 6D4.exe AppLaunch.exe PID 3528 wrote to memory of 1548 3528 6D4.exe AppLaunch.exe PID 3528 wrote to memory of 1548 3528 6D4.exe AppLaunch.exe PID 3528 wrote to memory of 1548 3528 6D4.exe AppLaunch.exe PID 3528 wrote to memory of 1548 3528 6D4.exe AppLaunch.exe PID 3528 wrote to memory of 1548 3528 6D4.exe AppLaunch.exe PID 3528 wrote to memory of 1548 3528 6D4.exe AppLaunch.exe PID 3528 wrote to memory of 1548 3528 6D4.exe AppLaunch.exe PID 3352 wrote to memory of 3348 3352 2770.exe PID 3352 wrote to memory of 3348 3352 2770.exe PID 3352 wrote to memory of 3348 3352 2770.exe PID 3352 wrote to memory of 1072 3352 explorer.exe PID 3352 wrote to memory of 1072 3352 explorer.exe PID 3352 wrote to memory of 1072 3352 explorer.exe PID 3352 wrote to memory of 1072 3352 explorer.exe PID 4328 wrote to memory of 4244 4328 1D0E.exe InstallSetup8.exe PID 4328 wrote to memory of 4244 4328 1D0E.exe InstallSetup8.exe PID 4328 wrote to memory of 4244 4328 1D0E.exe InstallSetup8.exe PID 3352 wrote to memory of 2136 3352 explorer.exe PID 3352 wrote to memory of 2136 3352 explorer.exe PID 3352 wrote to memory of 2136 3352 explorer.exe PID 4244 wrote to memory of 1632 4244 InstallSetup8.exe Broom.exe PID 4244 wrote to memory of 1632 4244 InstallSetup8.exe Broom.exe PID 4244 wrote to memory of 1632 4244 InstallSetup8.exe Broom.exe PID 3348 wrote to memory of 1756 3348 2770.exe schtasks.exe PID 3348 wrote to memory of 1756 3348 2770.exe schtasks.exe PID 3348 wrote to memory of 1756 3348 2770.exe schtasks.exe PID 400 wrote to memory of 1104 400 FD1D.exe FD1D.exe PID 400 wrote to memory of 1104 400 FD1D.exe FD1D.exe PID 400 wrote to memory of 1104 400 FD1D.exe FD1D.exe PID 400 wrote to memory of 1104 400 FD1D.exe FD1D.exe PID 400 wrote to memory of 1104 400 FD1D.exe FD1D.exe PID 400 wrote to memory of 1104 400 FD1D.exe FD1D.exe PID 400 wrote to memory of 1104 400 FD1D.exe FD1D.exe PID 400 wrote to memory of 1104 400 FD1D.exe FD1D.exe PID 400 wrote to memory of 1104 400 FD1D.exe FD1D.exe PID 400 wrote to memory of 1104 400 FD1D.exe FD1D.exe PID 1104 wrote to memory of 5092 1104 FD1D.exe icacls.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe"C:\Users\Admin\AppData\Local\Temp\a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3exe.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4712
-
C:\Users\Admin\AppData\Local\Temp\FD1D.exeC:\Users\Admin\AppData\Local\Temp\FD1D.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\FD1D.exeC:\Users\Admin\AppData\Local\Temp\FD1D.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\e4ecd1e9-f8b8-4619-a13d-bfe597d5fd6e" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\FD1D.exe"C:\Users\Admin\AppData\Local\Temp\FD1D.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\FD1D.exe"C:\Users\Admin\AppData\Local\Temp\FD1D.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
PID:3928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 5685⤵
- Program crash
PID:3368
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\C.dll1⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\C.dll2⤵
- Loads dropped DLL
PID:2784
-
C:\Users\Admin\AppData\Local\Temp\3E5.exeC:\Users\Admin\AppData\Local\Temp\3E5.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
C:\Users\Admin\AppData\Local\Temp\6D4.exeC:\Users\Admin\AppData\Local\Temp\6D4.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
C:\Users\Admin\AppData\Local\Temp\1220.exeC:\Users\Admin\AppData\Local\Temp\1220.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4916
-
C:\Users\Admin\AppData\Local\Temp\1D0E.exeC:\Users\Admin\AppData\Local\Temp\1D0E.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5084 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1824 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1476 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵PID:1532
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
PID:3992 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3932 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4860 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1972 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2660 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
PID:2308 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵PID:4764
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2780 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
PID:1836 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
PID:220 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵
- Executes dropped EXE
PID:1740 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵PID:4260
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2348.exeC:\Users\Admin\AppData\Local\Temp\2348.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4360 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2204 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵PID:2964
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:1736
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\2770.exeC:\Users\Admin\AppData\Local\Temp\2770.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN 2770.exe /TR "C:\Users\Admin\AppData\Local\Temp\2770.exe" /F2⤵
- Creates scheduled task(s)
PID:1756
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:1072
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3928 -ip 39281⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2770.exeC:\Users\Admin\AppData\Local\Temp\2770.exe1⤵
- Executes dropped EXE
PID:3448
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
PID:4972
-
C:\Users\Admin\AppData\Local\Temp\2770.exeC:\Users\Admin\AppData\Local\Temp\2770.exe1⤵
- Executes dropped EXE
PID:2112
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
290KB
MD5b6e9ec2a10fb6b8eaa96a916140244cb
SHA1b82aef0315c6341bac8e4cbe63c2e494bf194758
SHA25628ac808f2ace1fc11007ce590b9e65e00a15e69bd2cb637086ef36099d6952d9
SHA5123ea894125f706e751aec09fe5015ca7e604f153468b3833617a0b4cb3d3777d8535d98bead2f50c193fc8dafcc7d4d80ed629eb44c2b412720bf798c431f873c
-
Filesize
290KB
MD5b6e9ec2a10fb6b8eaa96a916140244cb
SHA1b82aef0315c6341bac8e4cbe63c2e494bf194758
SHA25628ac808f2ace1fc11007ce590b9e65e00a15e69bd2cb637086ef36099d6952d9
SHA5123ea894125f706e751aec09fe5015ca7e604f153468b3833617a0b4cb3d3777d8535d98bead2f50c193fc8dafcc7d4d80ed629eb44c2b412720bf798c431f873c
-
Filesize
6.4MB
MD5faa78f58b4f091f8c56ea622d8576703
SHA12bd05e7cf298f79bc7408f400e2f2fd37fc8bdf1
SHA256464c7ab944886103d617e334c94320344761a543de5395c6b541ae386b448ea0
SHA5123037aef0866b9957fd9f56691baa0e6557a9f46cd3695016dc3c829fc270393360b05e39fba19dc10cac06c2f51998716b3c15c57c3f0afe8c11b2a3709d467b
-
Filesize
6.4MB
MD5faa78f58b4f091f8c56ea622d8576703
SHA12bd05e7cf298f79bc7408f400e2f2fd37fc8bdf1
SHA256464c7ab944886103d617e334c94320344761a543de5395c6b541ae386b448ea0
SHA5123037aef0866b9957fd9f56691baa0e6557a9f46cd3695016dc3c829fc270393360b05e39fba19dc10cac06c2f51998716b3c15c57c3f0afe8c11b2a3709d467b
-
Filesize
1.8MB
MD5fac406eb3a620ec45654e087f68ccd9e
SHA102c21bd71ec411685102670cd4342a332ebaade0
SHA256de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340
SHA5122668c162ccc01f61a1a9ffec6b35a0c2f64b6f0f5a724f1563b3b23460ed17faa7e64d6817f0eaf7f9c38f3a1ac4fb730351d197b9fff051f25d6e1aac4d2b11
-
Filesize
1.8MB
MD5fac406eb3a620ec45654e087f68ccd9e
SHA102c21bd71ec411685102670cd4342a332ebaade0
SHA256de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340
SHA5122668c162ccc01f61a1a9ffec6b35a0c2f64b6f0f5a724f1563b3b23460ed17faa7e64d6817f0eaf7f9c38f3a1ac4fb730351d197b9fff051f25d6e1aac4d2b11
-
Filesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
Filesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
Filesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
Filesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
Filesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
Filesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
Filesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
Filesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
Filesize
2.9MB
MD52f084751d838cb9bfcc8538401245ca6
SHA16353a9b23d8e4b50e85cd8e352d4f8d33111b9c0
SHA256c189f0fb469d1614cabaf2c7ecad116504f2a89da8c51f371dd28571dc45a13c
SHA51293b8fc0d072f4c162267dcfe9e25e1ec5fe305f4e6e0a87dd84698ded16089430c2bda52129064efdfe22c8ea66566d85e55829837e044459c0fe7e0be55011d
-
Filesize
2.9MB
MD52f084751d838cb9bfcc8538401245ca6
SHA16353a9b23d8e4b50e85cd8e352d4f8d33111b9c0
SHA256c189f0fb469d1614cabaf2c7ecad116504f2a89da8c51f371dd28571dc45a13c
SHA51293b8fc0d072f4c162267dcfe9e25e1ec5fe305f4e6e0a87dd84698ded16089430c2bda52129064efdfe22c8ea66566d85e55829837e044459c0fe7e0be55011d
-
Filesize
1.1MB
MD5acfa549f63796da0e45b5d96755c425b
SHA1e0b9ab6d6878926c95e7ead1dd5578aec686566a
SHA2564d588cff4cf07df5dc8e999f0962c2bfc83f69e8e6ec8df6acb06eb729b26480
SHA51295d5f5c71e25aa327b723893a0aefc7545993448d7c7e99fb2aa7dfbf7f699e2e5584ab745dcb1c18867520a0bb558c0a33371709174cf1c80c0be2e7e025743
-
Filesize
1.1MB
MD5acfa549f63796da0e45b5d96755c425b
SHA1e0b9ab6d6878926c95e7ead1dd5578aec686566a
SHA2564d588cff4cf07df5dc8e999f0962c2bfc83f69e8e6ec8df6acb06eb729b26480
SHA51295d5f5c71e25aa327b723893a0aefc7545993448d7c7e99fb2aa7dfbf7f699e2e5584ab745dcb1c18867520a0bb558c0a33371709174cf1c80c0be2e7e025743
-
Filesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
Filesize
1.6MB
MD54164fa66f608eb71f038fa7ee6ece5bc
SHA1d879704e3d4f1ddb97cde3100962dfb684458c27
SHA256b43fbe5adf27e984234a4abff46adc22241bcb5b894ce7b518aa024a4c6556f8
SHA51235dbc13c03cb155ad920fc82de78456cc0aa174671a7ac96953693111596be2bd30e4a0d35e2002f66ddc4e3341f90c3a2d71f35607eaca4673e6a5b6b76edb0
-
Filesize
1.6MB
MD54164fa66f608eb71f038fa7ee6ece5bc
SHA1d879704e3d4f1ddb97cde3100962dfb684458c27
SHA256b43fbe5adf27e984234a4abff46adc22241bcb5b894ce7b518aa024a4c6556f8
SHA51235dbc13c03cb155ad920fc82de78456cc0aa174671a7ac96953693111596be2bd30e4a0d35e2002f66ddc4e3341f90c3a2d71f35607eaca4673e6a5b6b76edb0
-
Filesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
Filesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
Filesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
Filesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
Filesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
Filesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
Filesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
Filesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
Filesize
290KB
MD5b6e9ec2a10fb6b8eaa96a916140244cb
SHA1b82aef0315c6341bac8e4cbe63c2e494bf194758
SHA25628ac808f2ace1fc11007ce590b9e65e00a15e69bd2cb637086ef36099d6952d9
SHA5123ea894125f706e751aec09fe5015ca7e604f153468b3833617a0b4cb3d3777d8535d98bead2f50c193fc8dafcc7d4d80ed629eb44c2b412720bf798c431f873c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD55bcf087f0a0fc64a98eab962fce882ec
SHA10c96e739052355914b6739af305df9a75285c14e
SHA25600e86a536dd563a7bd53efaa4ecbc82fa5115c34a2e3dbffb89989bd9f960f86
SHA512b55dffac1a248ee4e9ab81804bb432644848656fe8fd53c718c7ac99a76efead8b441956157e224c43a23695a04c85f6c90480d92c3f9cb43186ae222351fd01
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD51654cf4fade19e3c05c797add04df545
SHA14282f959769cb1e781c3b0b8a67203edf910f523
SHA256095007237fc270e78a560c37bed0b5936f445b7fd164470a2b1f00c18d1d4d7e
SHA512c823cfbaa3ad73d20e56759456f733ec35e3a1c52d8e6ff23e2edb83b45b18ffdbc8e6bd903cf7b8743504f4031038a00d006cea0e0c97c1920b2af451d7a52e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD59dde3c7a4fcf5ba2267532025ae1ea9b
SHA12fe27b6e981cb8400f47a28ae2e0096045488b94
SHA25674ac53dfa3dc20e44616fc98b080578a53583fa8527fd56440439753ce620918
SHA512cdd2f782b32398519023d98c3603a68abf2d17765bd65abe128368c56cbb550307aca0536b23be723b07b30b4a293551fb8377a4b868d30670763ffb98046364
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5c79fcf5d0c481f435be5d990ce829b02
SHA11db733937713ca8f59a17836e43225861b52f1b8
SHA256c2b2d39e8e49af92a5a94f0686db9e254c2862d35e523c634d0e2911ba63c88c
SHA512df8ca4273545459000fc1965781bfd5af5c5119d87985049bf073bc616c25ed03fb711be014cb07dee9127826a76999b0d8ab4180afe442df742e7d7bfd45369
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD51f7fcbc587ced693b69b9c23b28fc2f6
SHA127eef82f3da3ec57cac4044d2ebf045190cb2a17
SHA256824695d3077679a5649c2e954a9709391d54d31e41b259ba8336524c05ba8a00
SHA5125f119adf1e8b171a976ff666443099f9228b30d2beee0085af1d7f967ee04558ea864557205c87680c31a1c3cccd5cf92ae74ca42eec87be353ec3a7484d6335
-
Filesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
Filesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec