Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 05:41
Static task
static1
Behavioral task
behavioral1
Sample
fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe
Resource
win10v2004-20240426-en
General
-
Target
fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe
-
Size
89KB
-
MD5
4dd695aa2695ec57cd9998536790b010
-
SHA1
03a04922b652da53fa3fbdfd4588922b1896b2d4
-
SHA256
fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c
-
SHA512
1ac4b7f217d5aef7d946a488c3e547b097ed9f54ed1025c015853e47c9c8ad8a96fda821701c09914a49a02adb7ffc4461dc14817cc7ee9942ee134d5e313cfd
-
SSDEEP
1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEnV:BDeb4T0daHy9DZc86yGUtnV
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE -
Detects executables packed with ASPack 22 IoCs
resource yara_rule behavioral1/memory/2896-0-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0001000000000028-9.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000155d4-15.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2472-24-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2520-32-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2520-37-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2472-38-0x00000000024B0000-0x00000000024CA000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2628-55-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2592-54-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000155d9-58.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2364-64-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2628-60-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2876-76-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/644-84-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/572-87-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1916-94-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1916-95-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2596-101-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2712-104-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2712-107-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2896-110-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2472-141-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack -
Executes dropped EXE 12 IoCs
pid Process 2472 SVCHOST.EXE 2520 SVCHOST.EXE 2792 SVCHOST.EXE 2592 SVCHOST.EXE 2628 SVCHOST.EXE 2364 SPOOLSV.EXE 2876 SVCHOST.EXE 644 SVCHOST.EXE 572 SPOOLSV.EXE 1916 SPOOLSV.EXE 2596 SVCHOST.EXE 2712 SPOOLSV.EXE -
Loads dropped DLL 20 IoCs
pid Process 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened for modification F:\Recycled\desktop.ini fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\J: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\Q: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\V: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\I: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\T: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\Y: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\X: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\Z: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\E: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\N: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\W: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\H: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\O: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\L: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\M: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\U: fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened (read-only) \??\H: SVCHOST.EXE -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL\COMMAND fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1128 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2472 SVCHOST.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2364 SPOOLSV.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2472 SVCHOST.EXE 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 2472 SVCHOST.EXE 2520 SVCHOST.EXE 2792 SVCHOST.EXE 2592 SVCHOST.EXE 2628 SVCHOST.EXE 2364 SPOOLSV.EXE 2876 SVCHOST.EXE 644 SVCHOST.EXE 572 SPOOLSV.EXE 1916 SPOOLSV.EXE 2596 SVCHOST.EXE 2712 SPOOLSV.EXE 1128 WINWORD.EXE 1128 WINWORD.EXE -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2472 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 28 PID 2896 wrote to memory of 2472 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 28 PID 2896 wrote to memory of 2472 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 28 PID 2896 wrote to memory of 2472 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 28 PID 2472 wrote to memory of 2520 2472 SVCHOST.EXE 29 PID 2472 wrote to memory of 2520 2472 SVCHOST.EXE 29 PID 2472 wrote to memory of 2520 2472 SVCHOST.EXE 29 PID 2472 wrote to memory of 2520 2472 SVCHOST.EXE 29 PID 2472 wrote to memory of 2792 2472 SVCHOST.EXE 30 PID 2472 wrote to memory of 2792 2472 SVCHOST.EXE 30 PID 2472 wrote to memory of 2792 2472 SVCHOST.EXE 30 PID 2472 wrote to memory of 2792 2472 SVCHOST.EXE 30 PID 2792 wrote to memory of 2592 2792 SVCHOST.EXE 31 PID 2792 wrote to memory of 2592 2792 SVCHOST.EXE 31 PID 2792 wrote to memory of 2592 2792 SVCHOST.EXE 31 PID 2792 wrote to memory of 2592 2792 SVCHOST.EXE 31 PID 2792 wrote to memory of 2628 2792 SVCHOST.EXE 32 PID 2792 wrote to memory of 2628 2792 SVCHOST.EXE 32 PID 2792 wrote to memory of 2628 2792 SVCHOST.EXE 32 PID 2792 wrote to memory of 2628 2792 SVCHOST.EXE 32 PID 2792 wrote to memory of 2364 2792 SVCHOST.EXE 33 PID 2792 wrote to memory of 2364 2792 SVCHOST.EXE 33 PID 2792 wrote to memory of 2364 2792 SVCHOST.EXE 33 PID 2792 wrote to memory of 2364 2792 SVCHOST.EXE 33 PID 2364 wrote to memory of 2876 2364 SPOOLSV.EXE 34 PID 2364 wrote to memory of 2876 2364 SPOOLSV.EXE 34 PID 2364 wrote to memory of 2876 2364 SPOOLSV.EXE 34 PID 2364 wrote to memory of 2876 2364 SPOOLSV.EXE 34 PID 2364 wrote to memory of 644 2364 SPOOLSV.EXE 35 PID 2364 wrote to memory of 644 2364 SPOOLSV.EXE 35 PID 2364 wrote to memory of 644 2364 SPOOLSV.EXE 35 PID 2364 wrote to memory of 644 2364 SPOOLSV.EXE 35 PID 2364 wrote to memory of 572 2364 SPOOLSV.EXE 36 PID 2364 wrote to memory of 572 2364 SPOOLSV.EXE 36 PID 2364 wrote to memory of 572 2364 SPOOLSV.EXE 36 PID 2364 wrote to memory of 572 2364 SPOOLSV.EXE 36 PID 2472 wrote to memory of 1916 2472 SVCHOST.EXE 37 PID 2472 wrote to memory of 1916 2472 SVCHOST.EXE 37 PID 2472 wrote to memory of 1916 2472 SVCHOST.EXE 37 PID 2472 wrote to memory of 1916 2472 SVCHOST.EXE 37 PID 2896 wrote to memory of 2596 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 38 PID 2896 wrote to memory of 2596 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 38 PID 2896 wrote to memory of 2596 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 38 PID 2896 wrote to memory of 2596 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 38 PID 2472 wrote to memory of 2700 2472 SVCHOST.EXE 39 PID 2472 wrote to memory of 2700 2472 SVCHOST.EXE 39 PID 2472 wrote to memory of 2700 2472 SVCHOST.EXE 39 PID 2472 wrote to memory of 2700 2472 SVCHOST.EXE 39 PID 2896 wrote to memory of 2712 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 40 PID 2896 wrote to memory of 2712 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 40 PID 2896 wrote to memory of 2712 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 40 PID 2896 wrote to memory of 2712 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 40 PID 2700 wrote to memory of 1664 2700 userinit.exe 41 PID 2700 wrote to memory of 1664 2700 userinit.exe 41 PID 2700 wrote to memory of 1664 2700 userinit.exe 41 PID 2700 wrote to memory of 1664 2700 userinit.exe 41 PID 2896 wrote to memory of 1128 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 43 PID 2896 wrote to memory of 1128 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 43 PID 2896 wrote to memory of 1128 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 43 PID 2896 wrote to memory of 1128 2896 fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe"C:\Users\Admin\AppData\Local\Temp\fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2520
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2592
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2876
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:644
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:572
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1916
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE4⤵PID:1664
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2596
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2712
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
89KB
MD58e1b10c7e1e50c4fe85cdb1864a5a73d
SHA17b8bde9b5d26e87afe890ee7a25cf5e300f0dba7
SHA2568455a6c893ac05087e0c185a2950efa3205e397560fdd6c43c4b657901d4bbd3
SHA512008f021902141f1e43c56149bdc71db940fe897ba2e58ba35716e5950c6477a0f7355d521215c530d5be3e79516f74abbc370d14f02dca16e89843d20b167a35
-
Filesize
89KB
MD5e0b8ab1f8464997a9020aa24aad27489
SHA1107cd2088257064adaa1d6344696bfc8b3f58715
SHA25647b8b0eb4c83a0a86348f8b341bd1ce51e84d633086572e9f759b519fe2696c3
SHA5121c67980938d73bac5345d48db993f851f42178f7b813b4d712158de62fab56ce2814f9733f00f8c3bff7899cfa52a379e941c0ae774afb199764ff86a1b3bc2f
-
Filesize
89KB
MD5b7b0f76351134540dd6c1a768b8d161f
SHA1992fb326344dda87818991b5eebc6e6083105fbb
SHA2569d91e22e358fa941a2bb9ab2e5fb23af07e0ff853f44738c5619d5bf3b780b02
SHA512efda314e1301fe0448e59a771622b233181c73dd6d356086195382c408dab319c1125a2474193a12a16f79b2ecd41b57bda29afb8f1a2d48f3ada97d282b4035