Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe
Resource
win10v2004-20240426-en
General
-
Target
52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe
-
Size
97KB
-
MD5
480412c2c0d22dc5b03edcfe75dc1b5c
-
SHA1
5e476973313e9fbeab892d3d6101093f3b42bf1a
-
SHA256
52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53
-
SHA512
33e4f2e9c74a26cde8301063e370d5bec63f844037b01b382ab87a668c77262c5471103f48083aee72401e2fd752ab10f87040457c7ff0b1f0b30786a5e3273a
-
SSDEEP
1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIn:J8dfX7y9DZ+N7eB+tIn
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe -
Executes dropped EXE 12 IoCs
pid Process 2744 SVCHOST.EXE 376 SVCHOST.EXE 2596 SVCHOST.EXE 2864 SVCHOST.EXE 2860 SVCHOST.EXE 2540 SPOOLSV.EXE 2444 SVCHOST.EXE 2504 SVCHOST.EXE 2488 SPOOLSV.EXE 1492 SPOOLSV.EXE 2004 SVCHOST.EXE 1240 SPOOLSV.EXE -
Loads dropped DLL 21 IoCs
pid Process 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened for modification F:\Recycled\desktop.ini 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\I: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\Z: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\K: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\W: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\E: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\L: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\N: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\M: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\P: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\U: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\R: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\V: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\X: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\J: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\Q: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\Y: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\H: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\T: 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1912 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2596 SVCHOST.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2540 SPOOLSV.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE 2744 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 2744 SVCHOST.EXE 376 SVCHOST.EXE 2596 SVCHOST.EXE 2864 SVCHOST.EXE 2860 SVCHOST.EXE 2540 SPOOLSV.EXE 2444 SVCHOST.EXE 2504 SVCHOST.EXE 2488 SPOOLSV.EXE 1492 SPOOLSV.EXE 2004 SVCHOST.EXE 1240 SPOOLSV.EXE 1912 WINWORD.EXE 1912 WINWORD.EXE -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2744 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 28 PID 1712 wrote to memory of 2744 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 28 PID 1712 wrote to memory of 2744 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 28 PID 1712 wrote to memory of 2744 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 28 PID 2744 wrote to memory of 376 2744 SVCHOST.EXE 29 PID 2744 wrote to memory of 376 2744 SVCHOST.EXE 29 PID 2744 wrote to memory of 376 2744 SVCHOST.EXE 29 PID 2744 wrote to memory of 376 2744 SVCHOST.EXE 29 PID 2744 wrote to memory of 2596 2744 SVCHOST.EXE 30 PID 2744 wrote to memory of 2596 2744 SVCHOST.EXE 30 PID 2744 wrote to memory of 2596 2744 SVCHOST.EXE 30 PID 2744 wrote to memory of 2596 2744 SVCHOST.EXE 30 PID 2596 wrote to memory of 2864 2596 SVCHOST.EXE 31 PID 2596 wrote to memory of 2864 2596 SVCHOST.EXE 31 PID 2596 wrote to memory of 2864 2596 SVCHOST.EXE 31 PID 2596 wrote to memory of 2864 2596 SVCHOST.EXE 31 PID 2596 wrote to memory of 2860 2596 SVCHOST.EXE 32 PID 2596 wrote to memory of 2860 2596 SVCHOST.EXE 32 PID 2596 wrote to memory of 2860 2596 SVCHOST.EXE 32 PID 2596 wrote to memory of 2860 2596 SVCHOST.EXE 32 PID 2596 wrote to memory of 2540 2596 SVCHOST.EXE 33 PID 2596 wrote to memory of 2540 2596 SVCHOST.EXE 33 PID 2596 wrote to memory of 2540 2596 SVCHOST.EXE 33 PID 2596 wrote to memory of 2540 2596 SVCHOST.EXE 33 PID 2540 wrote to memory of 2444 2540 SPOOLSV.EXE 34 PID 2540 wrote to memory of 2444 2540 SPOOLSV.EXE 34 PID 2540 wrote to memory of 2444 2540 SPOOLSV.EXE 34 PID 2540 wrote to memory of 2444 2540 SPOOLSV.EXE 34 PID 2540 wrote to memory of 2504 2540 SPOOLSV.EXE 35 PID 2540 wrote to memory of 2504 2540 SPOOLSV.EXE 35 PID 2540 wrote to memory of 2504 2540 SPOOLSV.EXE 35 PID 2540 wrote to memory of 2504 2540 SPOOLSV.EXE 35 PID 2540 wrote to memory of 2488 2540 SPOOLSV.EXE 36 PID 2540 wrote to memory of 2488 2540 SPOOLSV.EXE 36 PID 2540 wrote to memory of 2488 2540 SPOOLSV.EXE 36 PID 2540 wrote to memory of 2488 2540 SPOOLSV.EXE 36 PID 2744 wrote to memory of 1492 2744 SVCHOST.EXE 37 PID 2744 wrote to memory of 1492 2744 SVCHOST.EXE 37 PID 2744 wrote to memory of 1492 2744 SVCHOST.EXE 37 PID 2744 wrote to memory of 1492 2744 SVCHOST.EXE 37 PID 1712 wrote to memory of 2004 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 38 PID 1712 wrote to memory of 2004 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 38 PID 1712 wrote to memory of 2004 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 38 PID 1712 wrote to memory of 2004 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 38 PID 1712 wrote to memory of 1240 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 39 PID 1712 wrote to memory of 1240 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 39 PID 1712 wrote to memory of 1240 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 39 PID 1712 wrote to memory of 1240 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 39 PID 1712 wrote to memory of 1912 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 40 PID 1712 wrote to memory of 1912 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 40 PID 1712 wrote to memory of 1912 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 40 PID 1712 wrote to memory of 1912 1712 52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe 40 PID 1912 wrote to memory of 2052 1912 WINWORD.EXE 43 PID 1912 wrote to memory of 2052 1912 WINWORD.EXE 43 PID 1912 wrote to memory of 2052 1912 WINWORD.EXE 43 PID 1912 wrote to memory of 2052 1912 WINWORD.EXE 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe"C:\Users\Admin\AppData\Local\Temp\52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:376
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2864
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2860
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2444
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2504
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2488
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1492
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2004
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1240
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\52a80986112c040597d3f1960d4d2624f4186dcc09bcb6c6f6fce143eb512c53.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2052
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
97KB
MD5cade6f31a7020eadeb8daa9fed45f9de
SHA102692d3bad3276f85c8ea014142d91779aa64458
SHA2564d44faeeea56e714509280cc7ac25b777bffa6b3194c88f2300d8a44bb95f250
SHA5120380daa9606393221c3e2b1956ececdadcb03228f259e92a37031a6550d12b1e097ce4fdcd2c9a19f2a3d54ef052f2e041a57a4a04adb08e930b2d44a1a15d8f
-
Filesize
97KB
MD54ec1ddf94fc20c135ee59703caaeb4e7
SHA1748e23ed674c765f03dd32fca2b8a21b0031f215
SHA2567ffbc2840e8e6ea80249f3e6ebf58250ccf730a5fc0c43fa797d3ace1c127bc0
SHA512ce3b2675416b4c81fa17b912c7c29378a2093c05afb16512b4cd3e8973f220e7b96958800c4c70e7ce5d0fb562013542db108e5bb2ad9a27347c05d43582bb90
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
97KB
MD58ae21c598e6b57780368b0e0de29ee2f
SHA169904c126cd4a0a9dc0e6cf9cac82960f4d097b8
SHA25675c4885dacdf5c1ed8f9e436ad661a21a3550b09e811e074ea550a832bc60035
SHA5120bb7d3a6d80c6c72490fdcb4c4addf5baf60634c8b50a05801801661c6bb8bb4387b49faada6a4dedec227765057574045215600125fbf53c869345126b2a6cd
-
Filesize
97KB
MD5ba56b2e7367f1974b7983148e9851df4
SHA12d1ca3ab17d8c401e03b234735e3decb580d7596
SHA256fa8822e01511201ff389d8c43d0a845e2011c7e4cd7945decf816755b349053c
SHA512459774ac9edd8d16b9df0f87de764192f8cc5c52b02e5ce935ace7c03c7239f3ff63ec383a2ed50409e6e2fb6dfb10d71e04dfc26ef8115367e8ab136531ee52
-
Filesize
97KB
MD55d991bf61072dc47bbf6400efab0c5cc
SHA1f3df52f4afad6f22d60756228e0f8dd00dd2b435
SHA256429f33a54b5dbfe4b93052e226f3bca8889c33a60ed1a58cdac91e8795c2e31f
SHA5128f6eb9228f41f5f5c00f5ae68f317a8772a160bd83c8dda550d0703dd686cfc225138cf31d7004f7337a6497d9875f0b3dfab475f3fb64b31c9e833deba569f1