Analysis
-
max time kernel
154s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 23:27
Behavioral task
behavioral1
Sample
929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe
Resource
win10v2004-20240319-en
General
-
Target
929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe
-
Size
1.7MB
-
MD5
46034215fe80ef24bd31577f83800e2e
-
SHA1
577ec5cd3d0cd2439f53686d656b92e15ce516e9
-
SHA256
929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc
-
SHA512
6db639d2bff793a99259eb95bbd4b1b160bb6926bc5da757d82910467d0284918dc4e75b5694027170456267630eef9619912bba20a52922d9b4f03702cc416c
-
SSDEEP
49152:xml2nGuQ0FZBbuuEReOK2U6Azq93IlOaF1Ux:xYr0FZyUO53zXx
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 6 IoCs
Processes:
resource yara_rule behavioral1/memory/3004-9-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2440-57-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2408-58-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2156-96-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/3004-100-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2440-104-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2156-0-0x0000000000400000-0x0000000000420000-memory.dmp UPX C:\Program Files\Windows Sidebar\Shared Gadgets\italian beastiality lesbian licking young (Sandy,Jade).mpg.exe UPX behavioral1/memory/3004-9-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/2440-57-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/2408-58-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/2156-96-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/3004-100-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/2440-104-0x0000000000400000-0x0000000000420000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2156-0-0x0000000000400000-0x0000000000420000-memory.dmp upx C:\Program Files\Windows Sidebar\Shared Gadgets\italian beastiality lesbian licking young (Sandy,Jade).mpg.exe upx behavioral1/memory/3004-9-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2440-57-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2408-58-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2156-96-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/3004-100-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2440-104-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exedescription ioc process File opened (read-only) \??\O: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\S: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\Z: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\M: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\Q: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\R: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\H: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\I: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\J: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\B: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\K: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\L: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\N: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\P: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\T: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\U: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\V: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\A: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\E: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\G: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\W: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\X: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File opened (read-only) \??\Y: 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe -
Drops file in System32 directory 10 IoCs
Processes:
929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\japanese animal xxx [milf] (Sylvia).mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\System32\DriverStore\Temp\black cumshot lesbian girls mature .avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\italian cum gay full movie feet .zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\SysWOW64\FxsTmp\hardcore full movie latex .rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\SysWOW64\IME\shared\xxx [free] titts mature .mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\SysWOW64\config\systemprofile\american action hardcore [free] mistress .avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\SysWOW64\FxsTmp\russian cum lingerie hidden (Tatjana).avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\SysWOW64\IME\shared\lesbian [bangbus] titts fishy .mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\SysWOW64\config\systemprofile\russian horse fucking [bangbus] bedroom .avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian cum sperm big glans .zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe -
Drops file in Program Files directory 15 IoCs
Processes:
929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exedescription ioc process File created C:\Program Files\DVD Maker\Shared\gay several models titts .rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\italian beastiality lesbian licking young (Sandy,Jade).mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\gay hidden feet circumcision .zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files (x86)\Google\Temp\horse [milf] hole (Jenna,Sylvia).rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\trambling masturbation blondie (Jenna,Sarah).avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\japanese handjob beast [bangbus] hole .rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\danish beastiality horse full movie hole castration (Jade).rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files (x86)\Google\Update\Download\black gang bang gay [bangbus] glans .mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\brasilian horse trambling licking circumcision .mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files (x86)\Microsoft Office\Templates\gay hidden .rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\russian handjob beast hot (!) glans sm (Janette).zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files\Common Files\Microsoft Shared\american cumshot trambling several models feet mistress .avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files\Windows Journal\Templates\swedish beastiality lingerie several models titts .rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files (x86)\Common Files\microsoft shared\russian nude sperm several models (Tatjana).mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\american cum horse catfight hole .avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe -
Drops file in Windows directory 64 IoCs
Processes:
929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exedescription ioc process File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\sperm big leather (Jenna,Sarah).avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\animal blowjob full movie hole swallow .zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\norwegian trambling hot (!) YEâPSè& (Sonja,Sarah).avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\indian action gay uncut titts .rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\SoftwareDistribution\Download\lingerie lesbian balls .rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\horse gay girls (Sylvia).avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\lingerie voyeur hole ejaculation .rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\hardcore masturbation hole swallow .mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\nude horse full movie granny (Sandy,Liz).rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\nude lingerie full movie lady .avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\gang bang hardcore masturbation sweet (Ashley,Karin).mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\lingerie lesbian high heels (Sonja,Melissa).mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\swedish nude lingerie masturbation (Melissa).zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\canadian gay licking granny .zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\kicking sperm hidden hole .zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\security\templates\fucking several models blondie .avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\canadian bukkake full movie (Curtney).mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\chinese sperm hidden balls (Sonja,Janette).zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\canadian xxx [milf] .rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\beastiality horse licking (Sylvia).zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\spanish blowjob [free] (Jade).zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\bukkake voyeur sm (Sandy,Curtney).rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\american cum hardcore [bangbus] (Melissa).avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\swedish animal fucking uncut cock penetration (Janette).mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\lesbian catfight glans (Kathrin,Sylvia).mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\asian xxx sleeping feet high heels (Samantha).avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\gay big boots (Kathrin,Tatjana).mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\norwegian trambling lesbian titts ejaculation (Sylvia).mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\malaysia gay public cock .mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\mssrv.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\swedish animal blowjob catfight (Liz).mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\beast [bangbus] feet .mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\swedish cum horse uncut YEâPSè& .zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\french blowjob lesbian glans upskirt (Curtney).mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\spanish gay [milf] cock femdom .avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\bukkake [free] titts high heels (Melissa).rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\beastiality hardcore big .rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\african lingerie [milf] balls .mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\gay sleeping .avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\brasilian fetish gay uncut (Sarah).zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\norwegian blowjob hot (!) titts pregnant .zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\porn trambling [bangbus] feet latex (Janette).mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\sperm several models ìï .mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\beastiality sperm hot (!) swallow (Sonja,Karin).mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\lingerie [bangbus] feet YEâPSè& .mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\italian cum blowjob several models sm .avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\horse licking (Jade).rar.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\asian xxx masturbation 50+ (Christine,Jade).avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\animal xxx [milf] cock fishy .mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\kicking fucking full movie (Sylvia).mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\lesbian [bangbus] (Samantha).zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\french trambling masturbation ejaculation .mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\InstallTemp\russian action bukkake masturbation beautyfull .mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\chinese trambling uncut hole 40+ .zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\bukkake masturbation latex (Christine,Jade).mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\japanese gang bang fucking public .mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\french blowjob [bangbus] ash .avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\danish nude bukkake public (Liz).zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\swedish cumshot sperm masturbation .zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\canadian beast hot (!) feet penetration (Sylvia).mpg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\PLA\Templates\beast [bangbus] cock ash (Samantha).zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\gang bang lesbian lesbian titts .mpeg.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\spanish hardcore several models .avi.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\horse [free] YEâPSè& (Christine,Sylvia).zip.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exepid process 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2440 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 2408 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exedescription pid process target process PID 2156 wrote to memory of 3004 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe PID 2156 wrote to memory of 3004 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe PID 2156 wrote to memory of 3004 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe PID 2156 wrote to memory of 3004 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe PID 2156 wrote to memory of 2408 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe PID 2156 wrote to memory of 2408 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe PID 2156 wrote to memory of 2408 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe PID 2156 wrote to memory of 2408 2156 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe PID 3004 wrote to memory of 2440 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe PID 3004 wrote to memory of 2440 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe PID 3004 wrote to memory of 2440 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe PID 3004 wrote to memory of 2440 3004 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe 929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe"C:\Users\Admin\AppData\Local\Temp\929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe"C:\Users\Admin\AppData\Local\Temp\929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe"C:\Users\Admin\AppData\Local\Temp\929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2440
-
-
-
C:\Users\Admin\AppData\Local\Temp\929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe"C:\Users\Admin\AppData\Local\Temp\929d198f356efa5b08054d4d0008845c6cf03bda5cd1fad151c5fefc1e6841dc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2408
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Sidebar\Shared Gadgets\italian beastiality lesbian licking young (Sandy,Jade).mpg.exe
Filesize594KB
MD5cefcb100eae12e0e431a254d24e8b71f
SHA1e66184c07f45fc4a63b206282c10c1f777b9041f
SHA2562034ea248f4e593161a25695d20b780eff0200b30e92e147c4792d5b2c77a85a
SHA512ed24a9d4feda405dce2f1cf741de791bf4da2379d4cf9d7ce2a6f9d4c4a232e78ec5b0bae80fecdcaca63f5c23d23d0c5627c70586bd0390f2e0795cb79b3aae
-
Filesize
183B
MD57e01dc3087852f152b614d51c75a90ec
SHA1bde6a5a2d6479d5805c168baaf5903488e165d7b
SHA256fbbcfda62edc9276a5f221a00dabc87fec936ae1b27bea9cb4f7043aba988bc8
SHA51260014cb79fb8d2ff31fc859fded51cacac113fd441144fb51a505d5a4d02998b7677b7fc42abf38e5376d12033318789627149e4529d746366e147baebed8adc