Analysis
- max time kernel
117s - max time network
112s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
24/08/2024, 13:44
Behavioral task
behavioral1
Sample
193aa23fd5363803b9bbb1df0c9b79c0N.exe
Resource
win7-20240705-en
windows7-x64
20 signatures
120 seconds
General
- Target 193aa23fd5363803b9bbb1df0c9b79c0N.exe
- Size 450KB
- Sample240824-q13mhsvbmp
- SHA256 34f2b3db88514574c816025191ee7331c912567f28b2e3179618022b3c19fb86
- MD5 193aa23fd5363803b9bbb1df0c9b79c0
- SHA1 a47baf7ec48cc4c7e2eac39f3c7787da14e06deb
- SHA512 7700926aa0a450ea4400619884a24385ce03d9b3dd934180089afeb90d51eb70913e0d6f6e8605e86b14b2ff47d9c44f54082f78b09daee9f79b1651a4c07ae0
- SSDEEP 12288:NadMRU/UP4heFjLDXRLKCoSuaTq2AWBjvrEH7Um:8wU/UwhWZBMArEH7Um
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 193aa23fd5363803b9bbb1df0c9b79c0N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 193aa23fd5363803b9bbb1df0c9b79c0N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 193aa23fd5363803b9bbb1df0c9b79c0N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe - Detects Floxif payload 1 IoCs
resource yara_rule behavioral2/files/0x00090000000233f0-2.dat floxif - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00090000000233f0-2.dat acprotect - Loads dropped DLL 1 IoCs
pid Process 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe -
resource yara_rule behavioral2/memory/2912-0-0x0000000000400000-0x00000000004B2000-memory.dmp upx behavioral2/files/0x00090000000233f0-2.dat upx behavioral2/memory/2912-5-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2912-7-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-9-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-18-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-10-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-20-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-19-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-25-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-28-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-27-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-34-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-35-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-36-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-38-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-39-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-50-0x0000000000400000-0x00000000004B2000-memory.dmp upx behavioral2/memory/2912-51-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-52-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2912-53-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-55-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2912-54-0x0000000000400000-0x00000000004B2000-memory.dmp upx behavioral2/memory/2912-56-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-59-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-60-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-64-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-66-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-70-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-72-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-74-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-77-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-79-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-82-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2912-81-0x0000000000400000-0x00000000004B2000-memory.dmp upx behavioral2/memory/2912-84-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-86-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-90-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-96-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-98-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-99-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-101-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-106-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-107-0x0000000003FD0000-0x000000000505E000-memory.dmp upx behavioral2/memory/2912-109-0x0000000003FD0000-0x000000000505E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 193aa23fd5363803b9bbb1df0c9b79c0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 193aa23fd5363803b9bbb1df0c9b79c0N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 193aa23fd5363803b9bbb1df0c9b79c0N.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\N: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\P: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\S: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\W: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\Y: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\H: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\Q: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\V: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\Z: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\e: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\J: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\K: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\O: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\T: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\U: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\E: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\G: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\I: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\L: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\R: 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened (read-only) \??\X: 193aa23fd5363803b9bbb1df0c9b79c0N.exe - Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 193aa23fd5363803b9bbb1df0c9b79c0N.exe File created C:\Program Files\Common Files\System\symsrv.dll 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 193aa23fd5363803b9bbb1df0c9b79c0N.exe File created \??\c:\program files\common files\system\symsrv.dll.000 193aa23fd5363803b9bbb1df0c9b79c0N.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 193aa23fd5363803b9bbb1df0c9b79c0N.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 193aa23fd5363803b9bbb1df0c9b79c0N.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language diskpart.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 193aa23fd5363803b9bbb1df0c9b79c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language diskpart.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language diskpart.exe - Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a54fc9f1d525247c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a54fc9f10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a54fc9f1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da54fc9f1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a54fc9f100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vds.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vds.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vds.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vds.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\AttributesTableCache = a2a0d0ebe5b9334487c068b6b72699c70000000000000000 vds.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeLoadDriverPrivilege 1564 vds.exe Token: SeLoadDriverPrivilege 1564 vds.exe Token: SeLoadDriverPrivilege 1564 vds.exe Token: SeLoadDriverPrivilege 1564 vds.exe Token: SeLoadDriverPrivilege 1564 vds.exe Token: SeLoadDriverPrivilege 1564 vds.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe Token: SeDebugPrivilege 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 784 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 8 PID 2912 wrote to memory of 792 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 9 PID 2912 wrote to memory of 64 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 13 PID 2912 wrote to memory of 2648 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 44 PID 2912 wrote to memory of 2700 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 45 PID 2912 wrote to memory of 2996 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 51 PID 2912 wrote to memory of 3400 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 56 PID 2912 wrote to memory of 3520 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 57 PID 2912 wrote to memory of 3712 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 58 PID 2912 wrote to memory of 3804 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 59 PID 2912 wrote to memory of 3864 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 60 PID 2912 wrote to memory of 3948 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 61 PID 2912 wrote to memory of 4076 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 62 PID 2912 wrote to memory of 2892 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 74 PID 2912 wrote to memory of 1140 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 76 PID 2912 wrote to memory of 2064 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 81 PID 2912 wrote to memory of 336 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 82 PID 2912 wrote to memory of 4768 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 84 PID 2912 wrote to memory of 4768 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 84 PID 2912 wrote to memory of 4768 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 84 PID 2912 wrote to memory of 1852 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 86 PID 2912 wrote to memory of 1852 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 86 PID 2912 wrote to memory of 1852 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 86 PID 1852 wrote to memory of 2444 1852 cmd.exe 88 PID 1852 wrote to memory of 2444 1852 cmd.exe 88 PID 1852 wrote to memory of 2444 1852 cmd.exe 88 PID 2912 wrote to memory of 448 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 95 PID 2912 wrote to memory of 448 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 95 PID 2912 wrote to memory of 448 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 95 PID 2912 wrote to memory of 2396 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 97 PID 2912 wrote to memory of 2396 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 97 PID 2912 wrote to memory of 2396 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 97 PID 2396 wrote to memory of 4756 2396 cmd.exe 99 PID 2396 wrote to memory of 4756 2396 cmd.exe 99 PID 2396 wrote to memory of 4756 2396 cmd.exe 99 PID 2912 wrote to memory of 4816 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 101 PID 2912 wrote to memory of 4816 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 101 PID 2912 wrote to memory of 4816 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 101 PID 2912 wrote to memory of 2328 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 103 PID 2912 wrote to memory of 2328 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 103 PID 2912 wrote to memory of 2328 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 103 PID 2328 wrote to memory of 1420 2328 cmd.exe 105 PID 2328 wrote to memory of 1420 2328 cmd.exe 105 PID 2328 wrote to memory of 1420 2328 cmd.exe 105 PID 2912 wrote to memory of 784 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 8 PID 2912 wrote to memory of 792 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 9 PID 2912 wrote to memory of 64 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 13 PID 2912 wrote to memory of 2648 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 44 PID 2912 wrote to memory of 2700 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 45 PID 2912 wrote to memory of 2996 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 51 PID 2912 wrote to memory of 3400 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 56 PID 2912 wrote to memory of 3520 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 57 PID 2912 wrote to memory of 3712 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 58 PID 2912 wrote to memory of 3804 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 59 PID 2912 wrote to memory of 3864 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 60 PID 2912 wrote to memory of 3948 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 61 PID 2912 wrote to memory of 4076 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 62 PID 2912 wrote to memory of 2892 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 74 PID 2912 wrote to memory of 1140 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 76 PID 2912 wrote to memory of 336 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 82 PID 2912 wrote to memory of 548 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 92 PID 2912 wrote to memory of 2760 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 94 PID 2912 wrote to memory of 3280 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 100 PID 2912 wrote to memory of 784 2912 193aa23fd5363803b9bbb1df0c9b79c0N.exe 8 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 193aa23fd5363803b9bbb1df0c9b79c0N.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2700
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2996
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\193aa23fd5363803b9bbb1df0c9b79c0N.exe"C:\Users\Admin\AppData\Local\Temp\193aa23fd5363803b9bbb1df0c9b79c0N.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo rescan > C:\Users\Admin\AppData\Local\Temp\diskpartlog.txt3⤵
- System Location Discovery: System Language Discovery
PID:4768
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c diskpart /s C:\Users\Admin\AppData\Local\Temp\diskpartlog.txt3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\diskpart.exediskpart /s C:\Users\Admin\AppData\Local\Temp\diskpartlog.txt4⤵
- System Location Discovery: System Language Discovery
PID:2444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo lis vol > C:\Users\Admin\AppData\Local\Temp\vol.txt3⤵
- System Location Discovery: System Language Discovery
PID:448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c diskpart /s C:\Users\Admin\AppData\Local\Temp\vol.txt > C:\Users\Admin\AppData\Local\Temp\voldiskpartlog.txt3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\diskpart.exediskpart /s C:\Users\Admin\AppData\Local\Temp\vol.txt4⤵
- System Location Discovery: System Language Discovery
PID:4756
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo lis disk > C:\Users\Admin\AppData\Local\Temp\disk.txt3⤵
- System Location Discovery: System Language Discovery
PID:4816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c diskpart /s C:\Users\Admin\AppData\Local\Temp\disk.txt > C:\Users\Admin\AppData\Local\Temp\diskdiskpartlog.txt3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\diskpart.exediskpart /s C:\Users\Admin\AppData\Local\Temp\disk.txt4⤵
- System Location Discovery: System Language Discovery
PID:1420
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3520
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3712
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3804
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4076
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2892
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1140
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2064
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:336
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1676
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:548
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2760
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3280
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 175B
- SHA256 eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
- MD5 1130c911bf5db4b8f7cf9b6f4b457623
- SHA1 48e734c4bc1a8b5399bff4954e54b268bde9d54c
- SHA512 94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\disk.txt
- Size 11B
- SHA256 2790606beac6ec65ea6b096c822186e83147a081da927fdcec7cd40a55c9549b
- MD5 eecea3a7227c13ccf9ff6b1b04c7f0b3
- SHA1 1238f4edfb5b4fde6035c8d6251ce0159cff2879
- SHA512 157e40c3c7a95226739d4ec8906d20c4bd3b7dc32809a8d6a39677fc9cfc6a9098737c178c5fea94000b346338bbac68ff879687254d40327f06f3599335007b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\diskdiskpartlog.txt
- Size 274B
- SHA256 78518f76987499344e88da5c2158cdb1b8a5d1aef53bc50f689f8359b58efba1
- MD5 973a2f1c341e0b6fdd75807ed491491d
- SHA1 1245df6bc8a2136862b27a58b150f80c244d7c2c
- SHA512 a1494bd684aaf62b76a9161bc078f65ba4d5d1dfab80e3d9c63f8df913de971d12592a7abafa3fa662266f68c7a1b27c32120c40df7aa165a83dd4ed63323180
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\diskpartlog.txt
- Size 9B
- SHA256 23f7ed0dae26693fc5232a2095b2eb30fc7d0df1a8c5bee171519c0eeb3c2705
- MD5 c1ee4c599b2b0b0715d523738f5df840
- SHA1 8ca3fbed5f075b8af5f7061837ca15cdd33e09a6
- SHA512 6fe28475ca506015bc615db1f25bdb8a08546dfa642027053bd6b785e45ab21baef0ea712727f57604a739458ff12a4f3f87676ed388dde5318bde88e4c16cc8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\vol.txt
- Size 10B
- SHA256 23f21c3fb12d231828aaf2c957a6a0c287cfda554719018bc4640b0f43bfb0ad
- MD5 36dadc207d52f4911efccfa285b9bb53
- SHA1 23d326e8cb2885e515fa0fa745af390d2d3392be
- SHA512 b90d2e5097d185aa3e8a9f6dcdc730e713823aa1ee3332f1de2a883e07f3c29a0324521336eec474078a13d55c609312012bc552b216591722cb86101099fab6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\voldiskpartlog.txt
- Size 592B
- SHA256 9813aa337bd0eafd0084df698839864e702d995c6915d0201c08c9b848f3eb39
- MD5 aacbf6deab416eedb669dc60a6b679cd
- SHA1 bd7c4b0dc40bba9bd92332e78be887065d1b3a82
- SHA512 729725ba7f9fe7add737bca63cc70622e14071a71b186bb0c954748bae6c2203514026492b93ed7036cf1e59124b7a0ce02f79cd053e9dd29c451a3a68583e1c
- MD5 SHA1 SHA512