Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
419bacbe17f2854a74f4dc8147e6b25a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
419bacbe17f2854a74f4dc8147e6b25a.exe
Resource
win10v2004-20231215-en
General
-
Target
419bacbe17f2854a74f4dc8147e6b25a.exe
-
Size
512KB
-
MD5
419bacbe17f2854a74f4dc8147e6b25a
-
SHA1
5a8c9da397dcbbe098d985da62858a1ab01e014a
-
SHA256
652f8702be627fc380f162a3d568d2214da9141b2494a47da1b958c9491ab2e8
-
SHA512
ecfac2a7e03fc0140184f430c5e4241852e09594cec84dc03c76632feab06efc9c39f0aa6292a5029daeae2bac2dfd9a2264cce37a5fdf6e3b755b23b13f1b9e
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5a
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" xcimqzoune.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xcimqzoune.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" xcimqzoune.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" xcimqzoune.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" xcimqzoune.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" xcimqzoune.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" xcimqzoune.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xcimqzoune.exe -
Executes dropped EXE 5 IoCs
pid Process 2272 xcimqzoune.exe 2572 skgmeuhpfvxpzwq.exe 2620 laimndrdsptuo.exe 2680 qojgniub.exe 2576 qojgniub.exe -
Loads dropped DLL 5 IoCs
pid Process 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 2272 xcimqzoune.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" xcimqzoune.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" xcimqzoune.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" xcimqzoune.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" xcimqzoune.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" xcimqzoune.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" xcimqzoune.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dkwxaoqo = "xcimqzoune.exe" skgmeuhpfvxpzwq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cbymebqg = "skgmeuhpfvxpzwq.exe" skgmeuhpfvxpzwq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "laimndrdsptuo.exe" skgmeuhpfvxpzwq.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: qojgniub.exe File opened (read-only) \??\k: qojgniub.exe File opened (read-only) \??\b: xcimqzoune.exe File opened (read-only) \??\m: qojgniub.exe File opened (read-only) \??\n: qojgniub.exe File opened (read-only) \??\i: qojgniub.exe File opened (read-only) \??\l: qojgniub.exe File opened (read-only) \??\g: xcimqzoune.exe File opened (read-only) \??\h: xcimqzoune.exe File opened (read-only) \??\i: xcimqzoune.exe File opened (read-only) \??\q: qojgniub.exe File opened (read-only) \??\a: qojgniub.exe File opened (read-only) \??\l: xcimqzoune.exe File opened (read-only) \??\m: xcimqzoune.exe File opened (read-only) \??\g: qojgniub.exe File opened (read-only) \??\w: qojgniub.exe File opened (read-only) \??\z: qojgniub.exe File opened (read-only) \??\a: xcimqzoune.exe File opened (read-only) \??\w: xcimqzoune.exe File opened (read-only) \??\g: qojgniub.exe File opened (read-only) \??\r: qojgniub.exe File opened (read-only) \??\z: qojgniub.exe File opened (read-only) \??\j: xcimqzoune.exe File opened (read-only) \??\q: xcimqzoune.exe File opened (read-only) \??\t: xcimqzoune.exe File opened (read-only) \??\h: qojgniub.exe File opened (read-only) \??\t: qojgniub.exe File opened (read-only) \??\b: qojgniub.exe File opened (read-only) \??\p: qojgniub.exe File opened (read-only) \??\x: qojgniub.exe File opened (read-only) \??\y: xcimqzoune.exe File opened (read-only) \??\l: qojgniub.exe File opened (read-only) \??\e: xcimqzoune.exe File opened (read-only) \??\n: xcimqzoune.exe File opened (read-only) \??\s: xcimqzoune.exe File opened (read-only) \??\u: xcimqzoune.exe File opened (read-only) \??\m: qojgniub.exe File opened (read-only) \??\u: qojgniub.exe File opened (read-only) \??\y: qojgniub.exe File opened (read-only) \??\k: xcimqzoune.exe File opened (read-only) \??\j: qojgniub.exe File opened (read-only) \??\o: qojgniub.exe File opened (read-only) \??\s: qojgniub.exe File opened (read-only) \??\r: qojgniub.exe File opened (read-only) \??\t: qojgniub.exe File opened (read-only) \??\k: qojgniub.exe File opened (read-only) \??\y: qojgniub.exe File opened (read-only) \??\h: qojgniub.exe File opened (read-only) \??\s: qojgniub.exe File opened (read-only) \??\v: xcimqzoune.exe File opened (read-only) \??\x: xcimqzoune.exe File opened (read-only) \??\z: xcimqzoune.exe File opened (read-only) \??\e: qojgniub.exe File opened (read-only) \??\x: qojgniub.exe File opened (read-only) \??\q: qojgniub.exe File opened (read-only) \??\p: xcimqzoune.exe File opened (read-only) \??\r: xcimqzoune.exe File opened (read-only) \??\a: qojgniub.exe File opened (read-only) \??\u: qojgniub.exe File opened (read-only) \??\b: qojgniub.exe File opened (read-only) \??\j: qojgniub.exe File opened (read-only) \??\o: xcimqzoune.exe File opened (read-only) \??\n: qojgniub.exe File opened (read-only) \??\o: qojgniub.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" xcimqzoune.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" xcimqzoune.exe -
AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1888-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x000b000000015610-6.dat autoit_exe behavioral1/files/0x000e000000012247-17.dat autoit_exe behavioral1/files/0x0008000000015d03-31.dat autoit_exe behavioral1/files/0x0021000000015c63-28.dat autoit_exe behavioral1/files/0x0005000000019371-72.dat autoit_exe behavioral1/files/0x0005000000019340-66.dat autoit_exe behavioral1/files/0x000500000001938e-77.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\qojgniub.exe 419bacbe17f2854a74f4dc8147e6b25a.exe File opened for modification C:\Windows\SysWOW64\qojgniub.exe 419bacbe17f2854a74f4dc8147e6b25a.exe File opened for modification C:\Windows\SysWOW64\xcimqzoune.exe 419bacbe17f2854a74f4dc8147e6b25a.exe File opened for modification C:\Windows\SysWOW64\skgmeuhpfvxpzwq.exe 419bacbe17f2854a74f4dc8147e6b25a.exe File created C:\Windows\SysWOW64\laimndrdsptuo.exe 419bacbe17f2854a74f4dc8147e6b25a.exe File opened for modification C:\Windows\SysWOW64\laimndrdsptuo.exe 419bacbe17f2854a74f4dc8147e6b25a.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll xcimqzoune.exe File created C:\Windows\SysWOW64\xcimqzoune.exe 419bacbe17f2854a74f4dc8147e6b25a.exe File created C:\Windows\SysWOW64\skgmeuhpfvxpzwq.exe 419bacbe17f2854a74f4dc8147e6b25a.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe qojgniub.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal qojgniub.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe qojgniub.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe qojgniub.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe qojgniub.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe qojgniub.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal qojgniub.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe qojgniub.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal qojgniub.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal qojgniub.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe qojgniub.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe qojgniub.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe qojgniub.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe qojgniub.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe qojgniub.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 419bacbe17f2854a74f4dc8147e6b25a.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh xcimqzoune.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf xcimqzoune.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" xcimqzoune.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 419bacbe17f2854a74f4dc8147e6b25a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat xcimqzoune.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F56BC5FF1A22D0D208D0A18B789165" 419bacbe17f2854a74f4dc8147e6b25a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2484 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 2572 skgmeuhpfvxpzwq.exe 2572 skgmeuhpfvxpzwq.exe 2572 skgmeuhpfvxpzwq.exe 2572 skgmeuhpfvxpzwq.exe 2572 skgmeuhpfvxpzwq.exe 2272 xcimqzoune.exe 2272 xcimqzoune.exe 2272 xcimqzoune.exe 2272 xcimqzoune.exe 2272 xcimqzoune.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2572 skgmeuhpfvxpzwq.exe 2680 qojgniub.exe 2680 qojgniub.exe 2680 qojgniub.exe 2680 qojgniub.exe 2572 skgmeuhpfvxpzwq.exe 2576 qojgniub.exe 2576 qojgniub.exe 2576 qojgniub.exe 2576 qojgniub.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2572 skgmeuhpfvxpzwq.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2572 skgmeuhpfvxpzwq.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2572 skgmeuhpfvxpzwq.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2572 skgmeuhpfvxpzwq.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2572 skgmeuhpfvxpzwq.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2572 skgmeuhpfvxpzwq.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2572 skgmeuhpfvxpzwq.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2572 skgmeuhpfvxpzwq.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2572 skgmeuhpfvxpzwq.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2572 skgmeuhpfvxpzwq.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 2572 skgmeuhpfvxpzwq.exe 2572 skgmeuhpfvxpzwq.exe 2572 skgmeuhpfvxpzwq.exe 2272 xcimqzoune.exe 2272 xcimqzoune.exe 2272 xcimqzoune.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2680 qojgniub.exe 2680 qojgniub.exe 2680 qojgniub.exe 2576 qojgniub.exe 2576 qojgniub.exe 2576 qojgniub.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 2572 skgmeuhpfvxpzwq.exe 2572 skgmeuhpfvxpzwq.exe 2572 skgmeuhpfvxpzwq.exe 2272 xcimqzoune.exe 2272 xcimqzoune.exe 2272 xcimqzoune.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2620 laimndrdsptuo.exe 2680 qojgniub.exe 2680 qojgniub.exe 2680 qojgniub.exe 2576 qojgniub.exe 2576 qojgniub.exe 2576 qojgniub.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2484 WINWORD.EXE 2484 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2272 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 28 PID 1888 wrote to memory of 2272 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 28 PID 1888 wrote to memory of 2272 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 28 PID 1888 wrote to memory of 2272 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 28 PID 1888 wrote to memory of 2572 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 29 PID 1888 wrote to memory of 2572 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 29 PID 1888 wrote to memory of 2572 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 29 PID 1888 wrote to memory of 2572 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 29 PID 1888 wrote to memory of 2680 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 30 PID 1888 wrote to memory of 2680 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 30 PID 1888 wrote to memory of 2680 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 30 PID 1888 wrote to memory of 2680 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 30 PID 1888 wrote to memory of 2620 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 31 PID 1888 wrote to memory of 2620 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 31 PID 1888 wrote to memory of 2620 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 31 PID 1888 wrote to memory of 2620 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 31 PID 2272 wrote to memory of 2576 2272 xcimqzoune.exe 32 PID 2272 wrote to memory of 2576 2272 xcimqzoune.exe 32 PID 2272 wrote to memory of 2576 2272 xcimqzoune.exe 32 PID 2272 wrote to memory of 2576 2272 xcimqzoune.exe 32 PID 1888 wrote to memory of 2484 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 33 PID 1888 wrote to memory of 2484 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 33 PID 1888 wrote to memory of 2484 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 33 PID 1888 wrote to memory of 2484 1888 419bacbe17f2854a74f4dc8147e6b25a.exe 33 PID 2484 wrote to memory of 1612 2484 WINWORD.EXE 36 PID 2484 wrote to memory of 1612 2484 WINWORD.EXE 36 PID 2484 wrote to memory of 1612 2484 WINWORD.EXE 36 PID 2484 wrote to memory of 1612 2484 WINWORD.EXE 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\419bacbe17f2854a74f4dc8147e6b25a.exe"C:\Users\Admin\AppData\Local\Temp\419bacbe17f2854a74f4dc8147e6b25a.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\xcimqzoune.exexcimqzoune.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\qojgniub.exeC:\Windows\system32\qojgniub.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2576
-
-
-
C:\Windows\SysWOW64\skgmeuhpfvxpzwq.exeskgmeuhpfvxpzwq.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2572
-
-
C:\Windows\SysWOW64\qojgniub.exeqojgniub.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2680
-
-
C:\Windows\SysWOW64\laimndrdsptuo.exelaimndrdsptuo.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2620
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1612
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5af01d326fe43fa13db89f66366536e24
SHA11b5573c05805f0c031213b870277705ce539c8a0
SHA256f1d6838de2c14e0a9a68edacbe786f732ab154e0e48cd2d00319f0e1f5f91bc9
SHA5127691cff89f8b6661cb73eb7a302c69a20bff581e800572979a750c89000c21534c91db0df4b8ecf45227a942b54d198394a3fd13f40d05cd18f3de2c0ba83caa
-
Filesize
512KB
MD5ae2196878c7fb6e00460b642f9df6197
SHA1f9755f1ffb15907d675d2a27ff3743054aecfb9e
SHA256f3ca4baec65b0eda2d28e508480e4d6996ea96eeb2f3e243f81bee6497b66f2a
SHA512f86663d26aee06a9b4825f27adc2717ee1110fa4f86d34e3061f8512d9d45e5a79cfd2a78d813bc19848ab0a6a3912ab9950f0b8109be36988fbcb47a41f95ab
-
Filesize
20KB
MD5a716be9358af7a7403960ac667c4697a
SHA18eeeb1d6e733172855d3c71b1c402600176bce12
SHA256c095e34f0be807f51096ff2e7c7a01aa7bdb53a8fd1da499e13d8858add5dfd2
SHA512fef41bdceace309f3bfce45e4f01c8f1bfd0a95b37197ef18f261e1a245c0a53981dc7ac6b5d0b43ac5797b8f5ec0eee803d742baff46bd336ec9351c60eacc9
-
Filesize
512KB
MD5ecabb7ace3bc0dd64cd87862c17a84bd
SHA164c804ff68e1ddba9e3120db7f06c1e5d720ed9a
SHA2561f952875ceb6ad1e1a506a3cb96ace9c6d26a85a21983c8dac568793ebad3577
SHA512dad329d255e7968b78443a565a8475e86a0abaf88b8e19dc6066e4f9b70ea0eef8a3719001abcf1946959e8eed2a4bc4f7340b4739bc39d0ee367b55c7256cf9
-
Filesize
512KB
MD5d3b429e8f112b9027f177c0fd052e9f6
SHA172de24a298812b0f50ee5a2c5a841dab28377065
SHA256b2074de0f21f2668a5b0f106bca536b1427a8a9271dcd02e6b02bd3ef82b8240
SHA51217204c1be2c70d41b6215066a0f871526ad3f4ed36c5440a072d8fd4d4209ef3b11de6594324df69d5d4abea8d66f3442a5d631a260976ba10eb36c60afe4a1a
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD57e342cfdcae5bcaef2d248e74c16dc6e
SHA1b314cb9096d2d262feaa453684b79d1cf2ba58de
SHA256b3efd8d6e5ef068c14cd8f26e743d93992ac483db6b15f050d8fca708c848295
SHA512428f3d844d85427e8911313937d6ae114182fe3390a4fad8e4eb0dc455b7cd43477b772e6c12d80de9996ca258b645d355466b41e925b96ae478e9e2f8a62683
-
Filesize
512KB
MD5eb3e887140152f8945e8eb4995fb6531
SHA14996b8544a5671d9dd58db3b348f51bba2f2244f
SHA25649d7b513f20de2e1ee981c1162c24273053ec7f629d6f7d4c23052cb3eaa525a
SHA512e57d3f2e0704c245b211b75b2acd910f7f8dd4da49ab3c3ee3bd289143a9ff293b608d1a3b48d849278a00061d6d0c0019f1ede2c21aa16c9bff97c7d6dab4a3
-
Filesize
512KB
MD5154310a7d99d96184af742f48641a36d
SHA123bcee9e28a69823ff072154087defa9835d3213
SHA2564455481e106c79561a95c4aa2999283540a620349f8a91b049aead12cb99ad5a
SHA512b6703b39c7be408c0cb5bb2378e2d129abba214d79801264d346a8ac003e76c3733d163d426b7e7ac1f5677cc302f96de4b11a4da6c5d900616b43c1236ac6cb