Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
ab0757415e5a33fde6893ba93d5683ff.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ab0757415e5a33fde6893ba93d5683ff.exe
Resource
win10v2004-20231215-en
General
-
Target
ab0757415e5a33fde6893ba93d5683ff.exe
-
Size
512KB
-
MD5
ab0757415e5a33fde6893ba93d5683ff
-
SHA1
0836ceb3d65019483a8a1664a80422dffdfec99d
-
SHA256
677fc2b026079044c61098fc32986c2624095fc78d0f478e74e588a559bba8a0
-
SHA512
3c13d8a82243d85f1462ad9951abdfe4d07fe3e65e1b63c70f23aebf70a27adaab84c5dff41bcd622d04497ec5e7bb69b0cd5b0ca95e07aab1bcaea6efb63565
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6a:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5n
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" qhwdtwsryw.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qhwdtwsryw.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" qhwdtwsryw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" qhwdtwsryw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" qhwdtwsryw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" qhwdtwsryw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" qhwdtwsryw.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" qhwdtwsryw.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 5 IoCs
pid Process 2788 qhwdtwsryw.exe 2780 hdjjxwslkoevhwr.exe 2732 morwnzgotwukd.exe 2704 ovvnmdik.exe 2576 ovvnmdik.exe -
Loads dropped DLL 5 IoCs
pid Process 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2788 qhwdtwsryw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" qhwdtwsryw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" qhwdtwsryw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" qhwdtwsryw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" qhwdtwsryw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" qhwdtwsryw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" qhwdtwsryw.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ovlpbhho = "qhwdtwsryw.exe" hdjjxwslkoevhwr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xyjjxmhk = "hdjjxwslkoevhwr.exe" hdjjxwslkoevhwr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "morwnzgotwukd.exe" hdjjxwslkoevhwr.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: ovvnmdik.exe File opened (read-only) \??\g: ovvnmdik.exe File opened (read-only) \??\y: ovvnmdik.exe File opened (read-only) \??\e: qhwdtwsryw.exe File opened (read-only) \??\u: qhwdtwsryw.exe File opened (read-only) \??\p: ovvnmdik.exe File opened (read-only) \??\p: ovvnmdik.exe File opened (read-only) \??\y: ovvnmdik.exe File opened (read-only) \??\s: qhwdtwsryw.exe File opened (read-only) \??\i: ovvnmdik.exe File opened (read-only) \??\x: ovvnmdik.exe File opened (read-only) \??\w: ovvnmdik.exe File opened (read-only) \??\z: ovvnmdik.exe File opened (read-only) \??\v: qhwdtwsryw.exe File opened (read-only) \??\k: ovvnmdik.exe File opened (read-only) \??\l: ovvnmdik.exe File opened (read-only) \??\r: ovvnmdik.exe File opened (read-only) \??\k: qhwdtwsryw.exe File opened (read-only) \??\m: ovvnmdik.exe File opened (read-only) \??\g: qhwdtwsryw.exe File opened (read-only) \??\v: ovvnmdik.exe File opened (read-only) \??\t: qhwdtwsryw.exe File opened (read-only) \??\y: qhwdtwsryw.exe File opened (read-only) \??\j: ovvnmdik.exe File opened (read-only) \??\n: ovvnmdik.exe File opened (read-only) \??\h: qhwdtwsryw.exe File opened (read-only) \??\j: qhwdtwsryw.exe File opened (read-only) \??\e: ovvnmdik.exe File opened (read-only) \??\m: ovvnmdik.exe File opened (read-only) \??\u: ovvnmdik.exe File opened (read-only) \??\x: ovvnmdik.exe File opened (read-only) \??\s: ovvnmdik.exe File opened (read-only) \??\t: ovvnmdik.exe File opened (read-only) \??\m: qhwdtwsryw.exe File opened (read-only) \??\w: qhwdtwsryw.exe File opened (read-only) \??\q: ovvnmdik.exe File opened (read-only) \??\t: ovvnmdik.exe File opened (read-only) \??\n: qhwdtwsryw.exe File opened (read-only) \??\q: qhwdtwsryw.exe File opened (read-only) \??\h: ovvnmdik.exe File opened (read-only) \??\j: ovvnmdik.exe File opened (read-only) \??\u: ovvnmdik.exe File opened (read-only) \??\v: ovvnmdik.exe File opened (read-only) \??\p: qhwdtwsryw.exe File opened (read-only) \??\z: qhwdtwsryw.exe File opened (read-only) \??\a: ovvnmdik.exe File opened (read-only) \??\a: ovvnmdik.exe File opened (read-only) \??\b: ovvnmdik.exe File opened (read-only) \??\i: qhwdtwsryw.exe File opened (read-only) \??\l: qhwdtwsryw.exe File opened (read-only) \??\e: ovvnmdik.exe File opened (read-only) \??\z: ovvnmdik.exe File opened (read-only) \??\b: ovvnmdik.exe File opened (read-only) \??\k: ovvnmdik.exe File opened (read-only) \??\o: ovvnmdik.exe File opened (read-only) \??\o: ovvnmdik.exe File opened (read-only) \??\a: qhwdtwsryw.exe File opened (read-only) \??\r: qhwdtwsryw.exe File opened (read-only) \??\i: ovvnmdik.exe File opened (read-only) \??\r: ovvnmdik.exe File opened (read-only) \??\g: ovvnmdik.exe File opened (read-only) \??\q: ovvnmdik.exe File opened (read-only) \??\x: qhwdtwsryw.exe File opened (read-only) \??\l: ovvnmdik.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" qhwdtwsryw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" qhwdtwsryw.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2976-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x000d0000000122b8-5.dat autoit_exe behavioral1/files/0x0008000000012233-17.dat autoit_exe behavioral1/files/0x0010000000014984-28.dat autoit_exe behavioral1/files/0x0008000000014ee2-36.dat autoit_exe behavioral1/files/0x0006000000016d18-73.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ovvnmdik.exe ab0757415e5a33fde6893ba93d5683ff.exe File opened for modification C:\Windows\SysWOW64\morwnzgotwukd.exe ab0757415e5a33fde6893ba93d5683ff.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll qhwdtwsryw.exe File opened for modification C:\Windows\SysWOW64\hdjjxwslkoevhwr.exe ab0757415e5a33fde6893ba93d5683ff.exe File created C:\Windows\SysWOW64\ovvnmdik.exe ab0757415e5a33fde6893ba93d5683ff.exe File created C:\Windows\SysWOW64\morwnzgotwukd.exe ab0757415e5a33fde6893ba93d5683ff.exe File created C:\Windows\SysWOW64\qhwdtwsryw.exe ab0757415e5a33fde6893ba93d5683ff.exe File opened for modification C:\Windows\SysWOW64\qhwdtwsryw.exe ab0757415e5a33fde6893ba93d5683ff.exe File created C:\Windows\SysWOW64\hdjjxwslkoevhwr.exe ab0757415e5a33fde6893ba93d5683ff.exe -
Drops file in Program Files directory 21 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ovvnmdik.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ovvnmdik.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ovvnmdik.exe File opened for modification C:\Program Files\SearchFormat.doc.exe ovvnmdik.exe File opened for modification C:\Program Files\SearchFormat.nal ovvnmdik.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ovvnmdik.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ovvnmdik.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ovvnmdik.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal ovvnmdik.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal ovvnmdik.exe File opened for modification \??\c:\Program Files\SearchFormat.doc.exe ovvnmdik.exe File opened for modification C:\Program Files\SearchFormat.doc.exe ovvnmdik.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ovvnmdik.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal ovvnmdik.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ovvnmdik.exe File opened for modification \??\c:\Program Files\SearchFormat.doc.exe ovvnmdik.exe File created \??\c:\Program Files\SearchFormat.doc.exe ovvnmdik.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ovvnmdik.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ovvnmdik.exe File opened for modification C:\Program Files\SearchFormat.nal ovvnmdik.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal ovvnmdik.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf ab0757415e5a33fde6893ba93d5683ff.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABDFAB0F967F19384783A46819839E4B0FB02FB4314023FE1BD45E709A8" ab0757415e5a33fde6893ba93d5683ff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" qhwdtwsryw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78768B3FE6822D8D272D0A68A0E9165" ab0757415e5a33fde6893ba93d5683ff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf qhwdtwsryw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" qhwdtwsryw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs qhwdtwsryw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2648 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2780 hdjjxwslkoevhwr.exe 2780 hdjjxwslkoevhwr.exe 2780 hdjjxwslkoevhwr.exe 2780 hdjjxwslkoevhwr.exe 2780 hdjjxwslkoevhwr.exe 2788 qhwdtwsryw.exe 2788 qhwdtwsryw.exe 2788 qhwdtwsryw.exe 2788 qhwdtwsryw.exe 2788 qhwdtwsryw.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2704 ovvnmdik.exe 2704 ovvnmdik.exe 2704 ovvnmdik.exe 2704 ovvnmdik.exe 2780 hdjjxwslkoevhwr.exe 2576 ovvnmdik.exe 2576 ovvnmdik.exe 2576 ovvnmdik.exe 2576 ovvnmdik.exe 2780 hdjjxwslkoevhwr.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2780 hdjjxwslkoevhwr.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2780 hdjjxwslkoevhwr.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2780 hdjjxwslkoevhwr.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2780 hdjjxwslkoevhwr.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2780 hdjjxwslkoevhwr.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2780 hdjjxwslkoevhwr.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2780 hdjjxwslkoevhwr.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2780 hdjjxwslkoevhwr.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2780 hdjjxwslkoevhwr.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2780 hdjjxwslkoevhwr.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 748 explorer.exe Token: SeShutdownPrivilege 748 explorer.exe Token: SeShutdownPrivilege 748 explorer.exe Token: SeShutdownPrivilege 748 explorer.exe Token: SeShutdownPrivilege 748 explorer.exe Token: SeShutdownPrivilege 748 explorer.exe Token: SeShutdownPrivilege 748 explorer.exe Token: SeShutdownPrivilege 748 explorer.exe Token: SeShutdownPrivilege 748 explorer.exe Token: SeShutdownPrivilege 748 explorer.exe Token: SeShutdownPrivilege 748 explorer.exe Token: SeShutdownPrivilege 748 explorer.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2780 hdjjxwslkoevhwr.exe 2780 hdjjxwslkoevhwr.exe 2780 hdjjxwslkoevhwr.exe 2788 qhwdtwsryw.exe 2788 qhwdtwsryw.exe 2788 qhwdtwsryw.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2704 ovvnmdik.exe 2704 ovvnmdik.exe 2704 ovvnmdik.exe 2576 ovvnmdik.exe 2576 ovvnmdik.exe 2576 ovvnmdik.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2976 ab0757415e5a33fde6893ba93d5683ff.exe 2780 hdjjxwslkoevhwr.exe 2780 hdjjxwslkoevhwr.exe 2780 hdjjxwslkoevhwr.exe 2788 qhwdtwsryw.exe 2788 qhwdtwsryw.exe 2788 qhwdtwsryw.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2732 morwnzgotwukd.exe 2704 ovvnmdik.exe 2704 ovvnmdik.exe 2704 ovvnmdik.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2648 WINWORD.EXE 2648 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2788 2976 ab0757415e5a33fde6893ba93d5683ff.exe 28 PID 2976 wrote to memory of 2788 2976 ab0757415e5a33fde6893ba93d5683ff.exe 28 PID 2976 wrote to memory of 2788 2976 ab0757415e5a33fde6893ba93d5683ff.exe 28 PID 2976 wrote to memory of 2788 2976 ab0757415e5a33fde6893ba93d5683ff.exe 28 PID 2976 wrote to memory of 2780 2976 ab0757415e5a33fde6893ba93d5683ff.exe 29 PID 2976 wrote to memory of 2780 2976 ab0757415e5a33fde6893ba93d5683ff.exe 29 PID 2976 wrote to memory of 2780 2976 ab0757415e5a33fde6893ba93d5683ff.exe 29 PID 2976 wrote to memory of 2780 2976 ab0757415e5a33fde6893ba93d5683ff.exe 29 PID 2976 wrote to memory of 2704 2976 ab0757415e5a33fde6893ba93d5683ff.exe 31 PID 2976 wrote to memory of 2704 2976 ab0757415e5a33fde6893ba93d5683ff.exe 31 PID 2976 wrote to memory of 2704 2976 ab0757415e5a33fde6893ba93d5683ff.exe 31 PID 2976 wrote to memory of 2704 2976 ab0757415e5a33fde6893ba93d5683ff.exe 31 PID 2976 wrote to memory of 2732 2976 ab0757415e5a33fde6893ba93d5683ff.exe 30 PID 2976 wrote to memory of 2732 2976 ab0757415e5a33fde6893ba93d5683ff.exe 30 PID 2976 wrote to memory of 2732 2976 ab0757415e5a33fde6893ba93d5683ff.exe 30 PID 2976 wrote to memory of 2732 2976 ab0757415e5a33fde6893ba93d5683ff.exe 30 PID 2788 wrote to memory of 2576 2788 qhwdtwsryw.exe 32 PID 2788 wrote to memory of 2576 2788 qhwdtwsryw.exe 32 PID 2788 wrote to memory of 2576 2788 qhwdtwsryw.exe 32 PID 2788 wrote to memory of 2576 2788 qhwdtwsryw.exe 32 PID 2976 wrote to memory of 2648 2976 ab0757415e5a33fde6893ba93d5683ff.exe 33 PID 2976 wrote to memory of 2648 2976 ab0757415e5a33fde6893ba93d5683ff.exe 33 PID 2976 wrote to memory of 2648 2976 ab0757415e5a33fde6893ba93d5683ff.exe 33 PID 2976 wrote to memory of 2648 2976 ab0757415e5a33fde6893ba93d5683ff.exe 33 PID 2648 wrote to memory of 1280 2648 WINWORD.EXE 37 PID 2648 wrote to memory of 1280 2648 WINWORD.EXE 37 PID 2648 wrote to memory of 1280 2648 WINWORD.EXE 37 PID 2648 wrote to memory of 1280 2648 WINWORD.EXE 37 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe"C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\qhwdtwsryw.exeqhwdtwsryw.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\ovvnmdik.exeC:\Windows\system32\ovvnmdik.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2576
-
-
-
C:\Windows\SysWOW64\hdjjxwslkoevhwr.exehdjjxwslkoevhwr.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2780
-
-
C:\Windows\SysWOW64\morwnzgotwukd.exemorwnzgotwukd.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2732
-
-
C:\Windows\SysWOW64\ovvnmdik.exeovvnmdik.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2704
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1280
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:748
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5e26430c37624e3ab19713cbd6e699f36
SHA1442d2553e6a3970c4ba5b0c222406182526e14d9
SHA2562153790dad2896fbf0bbecbfbc314b69dfee015a54f0ad96b44889bf9d9c3475
SHA5123fbd87515647e3d08e2b72140d93e07f553674e373d926065ee5e7d106dbd7c204b05a40dc5a3867c21b7002a9b8f4dffd83fc0b98a4dc1d5dd763662e1b6157
-
Filesize
512KB
MD58405e0885d4d9fbf9ce60826d000fc05
SHA13d84d9cfa33a37aa41fb2aee90ef8a8815c2140d
SHA2564b43391f1783b9e91299b693eef60b6cfae4076cd51a11c4731412ec4aac1687
SHA51232b8098f401baa9970a942f2ec4493219a7ef2dc7206908bbe0ffe798bdc5efc68412d3c1c75668cd81c976d172c31e5df3faae93d99daec097fda891faeb9f8
-
Filesize
512KB
MD51d9c62eed4cb136dc910fa675ce425e6
SHA149b8e691539e4e59ed409e4c97fed824d7f5c845
SHA25679db41555862520183452e4bd81eeae8a30c5835d8c0c5cd6557d72cef9b5d24
SHA5128f8959f157a99cc715f20b4b0ee56d9b95660475e6c0806376e2954ef081a030272cf221aabb80485a5fb04db16197e4fecb17c31ccd7ddab182f67edd960179
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5d7e73bed82caedd8bce03b8dc1dca676
SHA11719572ca59221b607521eaa7ed11035a9c14740
SHA2561702b5b850227106541acd46ca577db6fe92336c9c4ae096af090397209bf72f
SHA5122897480cd365f9e0994ca2491036f88e9dc1841788212b7ac034933439ef793324f0c9f5c579dd8c8339690ec7e5d1499242654c5fa0b1de86890eff13467093
-
Filesize
512KB
MD5059939daa9e98f9066118896c839ff24
SHA1a5527e8efed7405b25f3e1be2ee6b0e4dde40f5a
SHA2567ab8251cd7bdfc624087a3023bfb97a531104e55beaee657eeaccb54556cd61a
SHA512aed95b23ed4435fce62b6839e0a21e2d3bd784dd0da73fe255405cb0515af34a0f64b9a004ac77e2f36ce6c764d5ae62f59362cda25d0658cfc53b8573ebaba8