Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
29/01/2024, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
nlg_ns.msi
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
nlg_ns.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target nlg_ns.msi
- Size 14.0MB
- Sample240129-tmcqqadff7
- SHA256 8e12fc5aa85d6953ee731203e945ccacc4ded6a8aa9752c7331dcc17da501eae
- MD5 f1c700707adffb52929de6dff72b2840
- SHA1 190f21ef796aee07a2b4f906e7b2f7d915b18497
- SHA512 6b4c3e69822e83c977b35cd3f0b69fc38282b13dc9b07f97eb011737822624179560f5f5c1488ef487628a42eeea9c313837036d771e25a0e0358e104c5b65a2
- SSDEEP 196608:shhhkmqs4WU7FaOO13cdK1J/9V91xg9idpE1Qhv4RF5HVwZJfYabpY78vAdt2yT:sfiY6pg1MKL9O1QhAr1VwZJf9jvAdP
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4872 bdisc.exe - Loads dropped DLL 10 IoCs
pid Process 3280 MsiExec.exe 3280 MsiExec.exe 3280 MsiExec.exe 3280 MsiExec.exe 3280 MsiExec.exe 4872 bdisc.exe 4872 bdisc.exe 4872 bdisc.exe 4872 bdisc.exe 4872 bdisc.exe - Enumerates connected drives 3 TTPs 49 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: bdisc.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: bdisc.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: bdisc.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum bdisc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 bdisc.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{FF00326F-A38B-42AB-868D-8F1241D701F2} msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSID116.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID482.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID688.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID83E.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e58cf80.msi msiexec.exe File opened for modification C:\Windows\Installer\e58cf80.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID60A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIDA62.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003462af5746133e160000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003462af570000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003462af57000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3462af57000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003462af5700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 416 msiexec.exe 416 msiexec.exe 4872 bdisc.exe 4872 bdisc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2656 msiexec.exe Token: SeIncreaseQuotaPrivilege 2656 msiexec.exe Token: SeSecurityPrivilege 416 msiexec.exe Token: SeCreateTokenPrivilege 2656 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2656 msiexec.exe Token: SeLockMemoryPrivilege 2656 msiexec.exe Token: SeIncreaseQuotaPrivilege 2656 msiexec.exe Token: SeMachineAccountPrivilege 2656 msiexec.exe Token: SeTcbPrivilege 2656 msiexec.exe Token: SeSecurityPrivilege 2656 msiexec.exe Token: SeTakeOwnershipPrivilege 2656 msiexec.exe Token: SeLoadDriverPrivilege 2656 msiexec.exe Token: SeSystemProfilePrivilege 2656 msiexec.exe Token: SeSystemtimePrivilege 2656 msiexec.exe Token: SeProfSingleProcessPrivilege 2656 msiexec.exe Token: SeIncBasePriorityPrivilege 2656 msiexec.exe Token: SeCreatePagefilePrivilege 2656 msiexec.exe Token: SeCreatePermanentPrivilege 2656 msiexec.exe Token: SeBackupPrivilege 2656 msiexec.exe Token: SeRestorePrivilege 2656 msiexec.exe Token: SeShutdownPrivilege 2656 msiexec.exe Token: SeDebugPrivilege 2656 msiexec.exe Token: SeAuditPrivilege 2656 msiexec.exe Token: SeSystemEnvironmentPrivilege 2656 msiexec.exe Token: SeChangeNotifyPrivilege 2656 msiexec.exe Token: SeRemoteShutdownPrivilege 2656 msiexec.exe Token: SeUndockPrivilege 2656 msiexec.exe Token: SeSyncAgentPrivilege 2656 msiexec.exe Token: SeEnableDelegationPrivilege 2656 msiexec.exe Token: SeManageVolumePrivilege 2656 msiexec.exe Token: SeImpersonatePrivilege 2656 msiexec.exe Token: SeCreateGlobalPrivilege 2656 msiexec.exe Token: SeBackupPrivilege 1148 vssvc.exe Token: SeRestorePrivilege 1148 vssvc.exe Token: SeAuditPrivilege 1148 vssvc.exe Token: SeBackupPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: 33 1900 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1900 AUDIODG.EXE Token: SeBackupPrivilege 3636 srtasks.exe Token: SeRestorePrivilege 3636 srtasks.exe Token: SeSecurityPrivilege 3636 srtasks.exe Token: SeTakeOwnershipPrivilege 3636 srtasks.exe Token: SeBackupPrivilege 3636 srtasks.exe Token: SeRestorePrivilege 3636 srtasks.exe Token: SeSecurityPrivilege 3636 srtasks.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2656 msiexec.exe 2656 msiexec.exe 4872 bdisc.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4872 bdisc.exe 4872 bdisc.exe 4872 bdisc.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 416 wrote to memory of 3636 416 msiexec.exe 96 PID 416 wrote to memory of 3636 416 msiexec.exe 96 PID 416 wrote to memory of 3280 416 msiexec.exe 98 PID 416 wrote to memory of 3280 416 msiexec.exe 98 PID 416 wrote to memory of 3280 416 msiexec.exe 98 PID 416 wrote to memory of 4872 416 msiexec.exe 99 PID 416 wrote to memory of 4872 416 msiexec.exe 99 PID 416 wrote to memory of 4872 416 msiexec.exe 99 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\nlg_ns.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2656
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5AADCEADEBBE67353B7646026FAA7DA42⤵
- Loads dropped DLL
PID:3280
-
-
C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\bdisc.exe"C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\bdisc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4872
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x548 0x5441⤵
- Suspicious use of AdjustPrivilegeToken
PID:1900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58cf83.rbs
- Size 2KB
- SHA256 934cb7215aa4e8da8aaa8c0d2ecd0badd8d00f4f69684febc271166ea0d79ad6
- MD5 aeaa853bf0e65df1d9e05e1011481812
- SHA1 ec8d8e00240beb16366e46769db687bd999c9697
- SHA512 e2fa12fa467f37c37a43e631378c823f67561486a924e1f42bbfc2dd9cb553ab4cc93ecbb430aecb9966f9d7f4fb880283d6321d04dc2fe1003778f7a2519988
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\Community.pak
- Size 448KB
- SHA256 cbd59ac3a83eb686e635dd2a5e6b97748247a83b343d38508d8412336c2e38c7
- MD5 cddbf282ea00f8d3d1eccacae6816e71
- SHA1 dadb29ce2bc266eb73f6578ea365ef8e4f1e577f
- SHA512 702ef551aa7f415662ec5bba3362c92ed23c42a4f47ee3f40fc5137041fbedf370e42e25296ab29c3da6ed4e5af4e5b3ae718903aaa0415b9f68a7cbba931554
- SSDEEP 12288:P+J7CduG5h5kp9hhIjwTrLj0EBypasHXcmVkxao:OGduG5h5iHh/Trfg9XcmVDo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\ControlzEx.dll
- Size 482KB
- SHA256 87835f654da870edf44d30079790ee932c3d3ee0a4cc37758c1c292a4482b1f8
- MD5 d8d2d75aee0617e919289d078848cc41
- SHA1 e6679aaaf424b41b7b195110c35539cde8365f72
- SHA512 f052d90df5d0cf63d1f30a68e4f5948788b2264c25b6bfd81ad859a24d02905bfeb664a81a0b0d528eb8961c4df9ccaee83f7cbb886eb063523f2b3ca69d9e37
- SSDEEP 6144:HUKrG6Trv16615Muviiif6VuC/FA+iUUKMoKY3mgHiEEiW1QoNYm0GAOa0FPs:HUKrGM5MuviB60C/FA+Sr1ZNyGIUPs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\apilocal.dll
- Size 2.6MB
- SHA256 3978bf742b01e01bc79ad6fed2dff66a87254cd9f7d8b1f13333f525bc4e7033
- MD5 731e7aa75276f9e4e51807ac7d5abbc5
- SHA1 384d4c94b9c238d2cf6bbf3627147337fc975bb7
- SHA512 bd3e4330ae906eac3c8cca7847ec31a43eb16c205aa5d3ff27059c19f5f30efdb56f60f97ca3bcab59434074df03521eb843b3b0abee5fb21bc6e4ecba5deba5
- SSDEEP 49152:M8XEH/aUGBsDOFVBZ/uPSu7QTjums0gRcFcQbt4qxUqKzlqJfNyqM:XgrGBt4Hq90/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\badatamain.dll
- Size 3.1MB
- SHA256 7fbb4587c013342bb71fbdb5764fe16f9586517fcdf6989af2e3706b610495f8
- MD5 c1fcfa195bda17377e4ef8a2c4768e97
- SHA1 00e1ce831b7b6c57045afa42dfac42e006d1ec46
- SHA512 dde424e76261886f2b8a8fe6dc4b4413aa8e413f0f589c790e7b00f6446aa836ef54877af17ac47b450b4f4915a298ad37b39efd3cd68f7860eaf3af24ecc5f2
- SSDEEP 98304:0k+luZIoj+HJFMRIbEiokM3zneiSBDyKFkI:0kpZB6HoYXoZoBDyKFT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\bdisc.exe
- Size 4.5MB
- SHA256 66351e9b6e34929bdcfac6e0850b5984a31da2eafa533f64a017ba59d59725c6
- MD5 c1ae2526f60db5d46ac965a692c54324
- SHA1 9748090ad118512cee3399110616a23b66613ae2
- SHA512 0e6aeb41ef3e917ef85cfc5c0f3d79f4598b2c4338cb9660b45ff58434e044a47f5142ddcce782c04424696e64c7615c7f12410cbb67372778f5408f4f38e41f
- SSDEEP 49152:VJMDJaw8PeOR0SeBqQ2Ngwwsq+3HRt1Pl7xa/OZJXrTbQiGuSNUaIc4gw9ZUgo8:8VzvpLwwsq+Bt1Pa/OZJXxuqSgo8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\tcpipsrc.dll
- Size 2.6MB
- SHA256 4152519cf63829822de0085e61782e442a80e7c1413206061dfdd14a1606823e
- MD5 4baaa5dc4f533c498530a6d10f47092f
- SHA1 fcff776d6b56b9f8d37163f5bf8d716714ae3e87
- SHA512 42ffce8195d9d09ba5652b42ebe890c22ad577cfa55dc6b10752c250cde3ea3bf535081c16bb8a0739173c1e0580c1e6f3da72956fb3e12fd8f527dc07af800a
- SSDEEP 49152:K3oc//////aRc2AVVdS53B2kTgDf9EaSSKjsZQ98t:K3oc//////a6xVrW2FL93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\temp.wav
- Size 2.6MB
- SHA256 ad0052657fb7df3d5776c9de2274b306c134195d1c1ee53c5d64a82e489f0811
- MD5 f33900a2b9598c5c439d1d957e269dda
- SHA1 f334ee79a8f6d23da354cfcd9785caac1462be85
- SHA512 028fe7c0cd784d668dd84cfb0f702ec0ff516f5a7ea40cdc7bd755bd293dd7113d764528fdc7312def9e66a3f9e69bf2af0fc1b913bc3baf40cefdbe25a97f60
- SSDEEP 49152:MB8ODCbisutDqa2pCmF1+7v0lyGcKOBu5vECdZB/TKPK7zTvHkwgW/AubPb0:MB5DCbiskOa2vc7v0l1cKOBu5vDZB/+B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSID116.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 2.3MB
- SHA256 16bef60e33df8c1134b3754cc7c399d484849c1b53610c602f968bb7b2c5eb4b
- MD5 5a6ed83bfd751ee62ea6a149d0a428af
- SHA1 2a0fca91970da44ee7b15961545c7222aac7470d
- SHA512 553c018ae7bb569e4935aaf3d627936f468781967296c131ff778e3837a3350ed3dea563c360dc98721d10bd05f536516e4d977d4de7a6f31e16b0bd83831a57
- SSDEEP 3072:bYJxwtjRkaMcWi/PkVcPAfvfXhO034s80Ts4Mt76rjdvuBDawsAQjTKntMQOEduG:bYJxCOaMssJXhOEj64MgyatTKnpVX3b
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{57af6234-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cf643a64-4eb3-4f20-90ee-952bfa7c5a63}_OnDiskSnapshotProp
- Size 6KB
- SHA256 f9742ad1b4c696158bcf25aabe1a9881d8b8ded7997f6809f5a79700fceaba1d
- MD5 0e52da9806d1c40c709e309533692099
- SHA1 8b993f4f58e0e1d893f22cd61d82d3c6be4b865a
- SHA512 c7ae69c3e2cb93b4822886edfba49d43723b6515f4cb164f0ebda955e81aea80a5f23926e121d1af88432bb8068fa8840a0c8350eb27dcd4a95d149921f0bba0
- SSDEEP 96:FWHNnc1KYFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQEJ:UNGvb++sVe
- MD5 SHA1 SHA512 SSDEEP