Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
05/12/2024, 18:28
Static task
static1
General
-
Target
d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
-
Size
3.1MB
-
MD5
ed3fa7460523c5ec9d4568e754624405
-
SHA1
88ad04cf36c7fe20644d48572ec2e70569c9581b
-
SHA256
d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c
-
SHA512
4ff0b5009effb0630cb3cd5dcd7291bc645cb2d59d1975eaef2cec17f379e00317c44de5ed4b07ec607745571521fff380acbfb98afe3710e5ec2dae36bd1add
-
SSDEEP
49152:ktPTO+1ofLg4mtu3dBRdUMqbmIZgFv2Adk1Vf7Y5XnQ96BsohwyVw:G7O+1GLotutB/UMqyIbJf7Y5XnQmBw
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
gcleaner
92.63.197.221
45.91.200.135
Extracted
cryptbot
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://atten-supporse.biz/api
Extracted
stealc
drum
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
xworm
185.196.8.239:7000
-
Install_directory
%Userprofile%
-
install_file
WindowsUpdaterConf.exe
-
telegram
https://api.telegram.org/bot8070077125:AAEdRIyp1anHye9Y0jcV8uNF6U4mmijN8Pk/sendMessage?chat_id=1818813749
Extracted
lumma
https://dare-curbys.biz/api
https://se-blurry.biz/api
https://atten-supporse.biz/api
https://zinc-sneark.biz/api
https://dwell-exclaim.biz/api
https://formy-spill.biz/api
https://covery-mover.biz/api
https://print-vexer.biz/api
Signatures
-
Amadey family
-
Cryptbot family
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/9620-37589-0x0000000000080000-0x000000000009A000-memory.dmp family_xworm -
Gcleaner family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 73ccf42900.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 73ccf42900.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 73ccf42900.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 73ccf42900.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 73ccf42900.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 73ccf42900.exe -
Stealc family
-
Xworm family
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 23df97b84f.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 92dfd41111.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 23df97b84f.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rhnew.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ab4d5787b4.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8536346613.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 73ccf42900.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 10128 powershell.exe 10204 powershell.exe 6764 powershell.exe 6852 powershell.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 23df97b84f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8536346613.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 73ccf42900.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 92dfd41111.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8536346613.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 73ccf42900.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 23df97b84f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rhnew.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rhnew.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ab4d5787b4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 92dfd41111.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ab4d5787b4.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdaterConf.lnk wL3EGdM.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdaterConf.lnk wL3EGdM.exe -
Executes dropped EXE 11 IoCs
pid Process 2484 skotes.exe 2280 92dfd41111.exe 1756 23df97b84f.exe 2272 rhnew.exe 2148 ab4d5787b4.exe 1952 8536346613.exe 988 f6b11cc3cc.exe 3512 73ccf42900.exe 3780 wL3EGdM.exe 9620 wL3EGdM.exe 7308 WindowsUpdaterConf.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine 73ccf42900.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine 92dfd41111.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine 23df97b84f.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine rhnew.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine ab4d5787b4.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine 8536346613.exe -
Loads dropped DLL 15 IoCs
pid Process 2568 d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe 2568 d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe 2484 skotes.exe 2484 skotes.exe 2484 skotes.exe 2484 skotes.exe 2484 skotes.exe 2484 skotes.exe 2484 skotes.exe 2484 skotes.exe 2484 skotes.exe 2484 skotes.exe 3780 wL3EGdM.exe 2280 92dfd41111.exe 9620 wL3EGdM.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 73ccf42900.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 73ccf42900.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\ab4d5787b4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012471001\\ab4d5787b4.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\8536346613.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012472001\\8536346613.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\f6b11cc3cc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012473001\\f6b11cc3cc.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\73ccf42900.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012474001\\73ccf42900.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\666999666 = "C:\\Users\\Admin\\AppData\\Roaming\\wL3EGdM.exe" wL3EGdM.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdaterConf = "C:\\Users\\Admin\\WindowsUpdaterConf.exe" wL3EGdM.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 151 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000500000001a4bd-151.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 2568 d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe 2484 skotes.exe 2280 92dfd41111.exe 1756 23df97b84f.exe 2272 rhnew.exe 2148 ab4d5787b4.exe 1952 8536346613.exe 3512 73ccf42900.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3780 set thread context of 9620 3780 wL3EGdM.exe 62 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92dfd41111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ab4d5787b4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8536346613.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6b11cc3cc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language f6b11cc3cc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73ccf42900.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhnew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wL3EGdM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsUpdaterConf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23df97b84f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage f6b11cc3cc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wL3EGdM.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 9748 timeout.exe -
Kills process with taskkill 5 IoCs
pid Process 984 taskkill.exe 2648 taskkill.exe 1796 taskkill.exe 2156 taskkill.exe 1656 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings firefox.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a ab4d5787b4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 ab4d5787b4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a ab4d5787b4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a ab4d5787b4.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6984 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2568 d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe 2484 skotes.exe 2280 92dfd41111.exe 1756 23df97b84f.exe 1756 23df97b84f.exe 1756 23df97b84f.exe 1756 23df97b84f.exe 1756 23df97b84f.exe 1756 23df97b84f.exe 2272 rhnew.exe 2148 ab4d5787b4.exe 1952 8536346613.exe 988 f6b11cc3cc.exe 3512 73ccf42900.exe 3512 73ccf42900.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 3512 73ccf42900.exe 3512 73ccf42900.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe 3780 wL3EGdM.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 2648 taskkill.exe Token: SeDebugPrivilege 1796 taskkill.exe Token: SeDebugPrivilege 2156 taskkill.exe Token: SeDebugPrivilege 1656 taskkill.exe Token: SeDebugPrivilege 984 taskkill.exe Token: SeDebugPrivilege 2492 firefox.exe Token: SeDebugPrivilege 2492 firefox.exe Token: SeDebugPrivilege 3512 73ccf42900.exe Token: SeDebugPrivilege 3780 wL3EGdM.exe Token: SeDebugPrivilege 9620 wL3EGdM.exe Token: SeDebugPrivilege 10128 powershell.exe Token: SeDebugPrivilege 10204 powershell.exe Token: SeDebugPrivilege 6764 powershell.exe Token: SeDebugPrivilege 6852 powershell.exe Token: SeDebugPrivilege 9620 wL3EGdM.exe Token: SeDebugPrivilege 7308 WindowsUpdaterConf.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 2568 d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 2492 firefox.exe 2492 firefox.exe 2492 firefox.exe 2492 firefox.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 2492 firefox.exe 2492 firefox.exe 2492 firefox.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe 988 f6b11cc3cc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 9620 wL3EGdM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2484 2568 d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe 30 PID 2568 wrote to memory of 2484 2568 d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe 30 PID 2568 wrote to memory of 2484 2568 d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe 30 PID 2568 wrote to memory of 2484 2568 d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe 30 PID 2484 wrote to memory of 2280 2484 skotes.exe 32 PID 2484 wrote to memory of 2280 2484 skotes.exe 32 PID 2484 wrote to memory of 2280 2484 skotes.exe 32 PID 2484 wrote to memory of 2280 2484 skotes.exe 32 PID 2484 wrote to memory of 1756 2484 skotes.exe 33 PID 2484 wrote to memory of 1756 2484 skotes.exe 33 PID 2484 wrote to memory of 1756 2484 skotes.exe 33 PID 2484 wrote to memory of 1756 2484 skotes.exe 33 PID 2484 wrote to memory of 2272 2484 skotes.exe 36 PID 2484 wrote to memory of 2272 2484 skotes.exe 36 PID 2484 wrote to memory of 2272 2484 skotes.exe 36 PID 2484 wrote to memory of 2272 2484 skotes.exe 36 PID 2484 wrote to memory of 2148 2484 skotes.exe 37 PID 2484 wrote to memory of 2148 2484 skotes.exe 37 PID 2484 wrote to memory of 2148 2484 skotes.exe 37 PID 2484 wrote to memory of 2148 2484 skotes.exe 37 PID 2484 wrote to memory of 1952 2484 skotes.exe 38 PID 2484 wrote to memory of 1952 2484 skotes.exe 38 PID 2484 wrote to memory of 1952 2484 skotes.exe 38 PID 2484 wrote to memory of 1952 2484 skotes.exe 38 PID 2484 wrote to memory of 988 2484 skotes.exe 39 PID 2484 wrote to memory of 988 2484 skotes.exe 39 PID 2484 wrote to memory of 988 2484 skotes.exe 39 PID 2484 wrote to memory of 988 2484 skotes.exe 39 PID 988 wrote to memory of 2648 988 f6b11cc3cc.exe 40 PID 988 wrote to memory of 2648 988 f6b11cc3cc.exe 40 PID 988 wrote to memory of 2648 988 f6b11cc3cc.exe 40 PID 988 wrote to memory of 2648 988 f6b11cc3cc.exe 40 PID 988 wrote to memory of 1796 988 f6b11cc3cc.exe 43 PID 988 wrote to memory of 1796 988 f6b11cc3cc.exe 43 PID 988 wrote to memory of 1796 988 f6b11cc3cc.exe 43 PID 988 wrote to memory of 1796 988 f6b11cc3cc.exe 43 PID 988 wrote to memory of 2156 988 f6b11cc3cc.exe 45 PID 988 wrote to memory of 2156 988 f6b11cc3cc.exe 45 PID 988 wrote to memory of 2156 988 f6b11cc3cc.exe 45 PID 988 wrote to memory of 2156 988 f6b11cc3cc.exe 45 PID 988 wrote to memory of 1656 988 f6b11cc3cc.exe 47 PID 988 wrote to memory of 1656 988 f6b11cc3cc.exe 47 PID 988 wrote to memory of 1656 988 f6b11cc3cc.exe 47 PID 988 wrote to memory of 1656 988 f6b11cc3cc.exe 47 PID 988 wrote to memory of 984 988 f6b11cc3cc.exe 49 PID 988 wrote to memory of 984 988 f6b11cc3cc.exe 49 PID 988 wrote to memory of 984 988 f6b11cc3cc.exe 49 PID 988 wrote to memory of 984 988 f6b11cc3cc.exe 49 PID 988 wrote to memory of 1704 988 f6b11cc3cc.exe 51 PID 988 wrote to memory of 1704 988 f6b11cc3cc.exe 51 PID 988 wrote to memory of 1704 988 f6b11cc3cc.exe 51 PID 988 wrote to memory of 1704 988 f6b11cc3cc.exe 51 PID 1704 wrote to memory of 2492 1704 firefox.exe 52 PID 1704 wrote to memory of 2492 1704 firefox.exe 52 PID 1704 wrote to memory of 2492 1704 firefox.exe 52 PID 1704 wrote to memory of 2492 1704 firefox.exe 52 PID 1704 wrote to memory of 2492 1704 firefox.exe 52 PID 1704 wrote to memory of 2492 1704 firefox.exe 52 PID 1704 wrote to memory of 2492 1704 firefox.exe 52 PID 1704 wrote to memory of 2492 1704 firefox.exe 52 PID 1704 wrote to memory of 2492 1704 firefox.exe 52 PID 1704 wrote to memory of 2492 1704 firefox.exe 52 PID 1704 wrote to memory of 2492 1704 firefox.exe 52 PID 1704 wrote to memory of 2492 1704 firefox.exe 52 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe"C:\Users\Admin\AppData\Local\Temp\d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\1012468001\92dfd41111.exe"C:\Users\Admin\AppData\Local\Temp\1012468001\92dfd41111.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\1012469001\23df97b84f.exe"C:\Users\Admin\AppData\Local\Temp\1012469001\23df97b84f.exe"3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1756
-
-
C:\Users\Admin\AppData\Local\Temp\1012470001\rhnew.exe"C:\Users\Admin\AppData\Local\Temp\1012470001\rhnew.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2272
-
-
C:\Users\Admin\AppData\Local\Temp\1012471001\ab4d5787b4.exe"C:\Users\Admin\AppData\Local\Temp\1012471001\ab4d5787b4.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2148
-
-
C:\Users\Admin\AppData\Local\Temp\1012472001\8536346613.exe"C:\Users\Admin\AppData\Local\Temp\1012472001\8536346613.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1952
-
-
C:\Users\Admin\AppData\Local\Temp\1012473001\f6b11cc3cc.exe"C:\Users\Admin\AppData\Local\Temp\1012473001\f6b11cc3cc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2492 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.0.157119843\1506448151" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1180 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8848fa71-4984-488c-9a74-12f21a09cf10} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 1296 10fd5858 gpu6⤵PID:1248
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.1.865771156\685589675" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1496 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24f1dd15-e036-49a5-8333-0e86ec44caa0} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 1512 d73958 socket6⤵PID:2848
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.2.1140510278\564608440" -childID 1 -isForBrowser -prefsHandle 2064 -prefMapHandle 2060 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 908 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {afb2dfd1-f262-4f94-8837-7e8c7c72d415} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 2076 1afcb558 tab6⤵PID:2688
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.3.1341630533\1996379942" -childID 2 -isForBrowser -prefsHandle 2640 -prefMapHandle 768 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 908 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ef2a76d-cb5b-4e74-8314-96cb0eab9e78} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 2652 d6bf58 tab6⤵PID:2444
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.4.437623077\1857447284" -childID 3 -isForBrowser -prefsHandle 3696 -prefMapHandle 3736 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 908 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {70fed9d3-a5d5-4543-a9d6-a8531ff65b31} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3760 1ec66e58 tab6⤵PID:3764
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.5.1002649926\1133845436" -childID 4 -isForBrowser -prefsHandle 3868 -prefMapHandle 3872 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 908 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0613c452-675d-48ac-b08d-e542ce5b9220} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3864 20533458 tab6⤵PID:3800
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.6.753351845\1797373074" -childID 5 -isForBrowser -prefsHandle 4060 -prefMapHandle 4064 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 908 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43abf643-6388-4f92-a094-bdc76de6560c} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4048 20534058 tab6⤵PID:3808
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1012474001\73ccf42900.exe"C:\Users\Admin\AppData\Local\Temp\1012474001\73ccf42900.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
-
C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:9620 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:10128
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wL3EGdM.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:10204
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\WindowsUpdaterConf.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6764
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsUpdaterConf.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6852
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsUpdaterConf" /tr "C:\Users\Admin\WindowsUpdaterConf.exe"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:6984
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c timeout /t 1 && DEL /f wL3EGdM.exe4⤵
- System Location Discovery: System Language Discovery
PID:9704 -
C:\Windows\SysWOW64\timeout.exetimeout /t 15⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:9748
-
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {F26D9B6D-6EBB-4857-8570-0D6EE9B71585} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]1⤵PID:7272
-
C:\Users\Admin\WindowsUpdaterConf.exeC:\Users\Admin\WindowsUpdaterConf.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:7308
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\download[1].htm
Filesize1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\activity-stream.discovery_stream.json.tmp
Filesize24KB
MD5f2763d826a067f5ca87c9ae30446dec6
SHA18e0c4a5b29918fd22e0e0833b8d93c0b837f0295
SHA2565691879b8d30ebac6047adfa8f2e84c671e9ada820f42049d9b597ca21ceef31
SHA512458f89286e09ea75c2d472fbbcf9a965c6cc21339de4f944e8c389bff69e25d158245f8ddf768016d29fc9ab9e30adb49a0c12f1c118fd3f3b2d1de6aee7cf0f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
1.9MB
MD5d37030e80f50aa7d45f15e0983fad330
SHA1906a1885d394107acab9d41402b0df195a327f82
SHA256a5373b0a6fb3af6cc0166168bff40c602b6a67d9404962e438b61273e874c1bc
SHA5121a06ed2cd745c8688b756656315c3bcb8b6465c9f616cc45b347d02070e9fc035efb82e03edffbca9a6765250deea26e01adba8ff99b132cebea071241ec413a
-
Filesize
4.2MB
MD5758ff78dfb784d7dd45d64c3414e65ab
SHA18867b7267b58752190b99bf8203305b2d3f88b27
SHA256843567bec6b0f3cbace108b441cc48a352e085ddf485bc04ed47947fe759369b
SHA51260c189db28534c4e7fd0ed7ef7283a1baae4d038c27a1ce724c0a06dbe2e66dac55ae4d66d5639ca51b5df7a3cae2bcb3a9358d90587323c4e3acbd43b07aeb1
-
Filesize
1.8MB
MD590aa0042c2825073aac9d8cb97a3696d
SHA13bc907a5ddd6172fb9ce4b672feed48e3c2da961
SHA256106d17aab9be8de992208dfce5f7fde982f0082d34dae389675ce1e19e168cae
SHA5121547e0ef3dd94c4e05f430be114dadabaca8c29c589d9ca27d141e0eb3508d9b5557755cc0d081833b993397203b14d10248a947c92fcf0caf86416a07fc13f9
-
Filesize
1.7MB
MD5659626f9b237cc63c9312b4ee6779fe4
SHA128a0255714ac4f52d892d6e5c912ee35294d41b9
SHA25646f5ccca9761ebfcaab4398177c12ce9138851f5d956ce77057b78e8e1ebcd23
SHA512e608a5f0dc3cd39d7b5606020438cb7d3b762b00ade7de509c95cf8a1917046998f4439f6434111b4504c4bccead9a1fd6a5c4b4778800e92d34aafeb0c92ffb
-
Filesize
5.0MB
MD53cefe657842d51dac2bae694606dcef9
SHA15d1a1be06fbf467999fafa247e2d9a88d79a5164
SHA256069a2de7d9a3cf067a8870596b6da48938a3110698dba7db83c622a3b9f74843
SHA5122dbf96f2d2a9683be5b4976dd3054a1b96780a13d52739c7a59406dcfa0389af47575b9d5a1c7b5e3d9e924420337cb402f080bc8ab3eb4853bb79e2d9036d10
-
Filesize
949KB
MD5607b571347184731f35542f8625a85dd
SHA1624b1a58c688cffcf2946b66c0100baca5b887fc
SHA25612f682be3ebf7eadeca00dc0a5932c26268ff16d47760b68b44afed4e385df4c
SHA512e885d78ec2c813e22c772ed99f09e68be16024334f867b8edacdbfbffbff527d2b02ccaf1df2f86b510bbc8e5a74d99298fec46a63a32c8678403067047d3194
-
Filesize
2.7MB
MD538b7f3afd27a489ce0bb5dd6013336a6
SHA1e0bd638da4d60d4d7da4018feaf6fe2660658b3f
SHA256ecadc37e114a2038d48c9709791157d27e9233243726a65f2099856817a0c68a
SHA5121ee01b32c2a16a8a389c3dd435a19dd6d22d255decb18486016b35d65224f4bee217ee4db0a79c3065cdc0ca9c0dd7e24fac8a699e68a8730e82458ae69f7e7c
-
Filesize
3.3MB
MD57823e902900881094372948957825fe1
SHA1297a663f3b64fb9863164d10ac698bef03dd3a0f
SHA25692d36e5fb3fdbf10ad10c7880c40013c2e21b8a49e20720137d2b4851681233f
SHA51260d4ea35cfec5154cfa3cb767de7c839ca8b3987b27599ea218ec1c47f1d111a59f193cd3cfd1266ae384434ae653f1e0a297f7222a2592e529b2b4404dd6238
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD50003d5a3c41562251f038386ec2e0eeb
SHA1f52da38b50fc386c82af5a76f789df056029db9a
SHA25631835ae3ff0269aa77f5dab5f141421f9ac0e413f15f6800dd27fe03c6346ea9
SHA512e0dbf55cb5bea8b82804e71fd240a94795a479077e63249b6eec82ba25aca013087e48575aaf0026f7a3618b06c4e595a234430cb5c39dc099627af90cfd0864
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD54cbc7e827482e87d71d5f962825e30a9
SHA1a048ea402799e82c7d38ed56f9fce580f3459b66
SHA256cf222b6269c3a97de5723979b205e907549bbd63b53001492bb4aee75f704f5a
SHA5127054798c86d40ed4cd4db22548a2a6f6bc65aaed26aab090d88b8e9a26d5d3e8f40ae322585ca930d8d6f760b87fbf7b3261595d09b9dd465f4d52403547df7d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\00363589-204d-4c79-a95e-8d85d42392b9
Filesize745B
MD539b14fba0374a3a2bd46667272734652
SHA1342ed10481d5e7d332e253a697c0fc7b1980cd3d
SHA25641916ab1ab093ce7477442cf34d08a2f10729773ee1acff094c22a29914459f9
SHA512888ebe1ff0bdb0e2dc37952b85f8718c06fdc13ffd5364d12ae8f9793d2bb8fa935c45b7ab5282af8a40d3cbc8f1f3925c6e5bbb996294351dcffc494db2f6a9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\87ef777d-7336-4dd0-bb7a-2a42ec4a57f0
Filesize11KB
MD5b6c96f1336a6f7528798ba2dbb68fe7e
SHA1d05077f235fc2e2cd257c187e0893fde932114b0
SHA2560d65523f7bd410933a58d0053c55a0ba2d3f333f3d0949a5a100aecbeb358d8a
SHA5126ce491b05229006299905cba4864f75fda72220bbeb47e7662a55a28678bf609e554388b01c912c5cc47d91c7122a0499455a629ae83b34dd024209930f1caaf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD596925bdfb8445fb329186c0ea42b8565
SHA12a3f1b3fbdc3d9d406e87a942609d09eead4fe7a
SHA2564cef3e9ce04e295d4c55d9845b6065db9d6ef66f6dd92bb4354af313794f5352
SHA5129fa961f473d786e676658914b9fa7b8922d51f16be6609cf553f1ab04b0ba85ae379429f8aacb7b51b35b2e568d3cb53c3fe7df87b576d042601030618d4bfef
-
Filesize
7KB
MD53a8cbf951f19e269ed80f90d4c5bd108
SHA192daaf518a8a31054ba2462e2f1a58ccc6b8b390
SHA25612fb0445e06cc17aed753501bf6fe474f67312ce35f290ef7d4c96723522dc8b
SHA512cdab451c4440e059b3772fdb848638a275dc193fe36cf05abdbefc7b573e86ee49a9184484433902e655de839c3108f0f533e54342439690a28c343e0993b64b
-
Filesize
7KB
MD5d7fd121f57e6dedd75c4881336ea3f58
SHA178812c8f7bd3e7e2624d0e88dc9acecf7bffb594
SHA2567a9a290cf4010a886250f48a503dc50210cce88b0bc7d78418684ce95951fd1b
SHA512deb45f0d12d51914c2b4691be76b164d2d3aadfa10de6f900d92bf42450c7e9b56092ef9577435dc3abdec46bbfd8d1b385fb77b0b203728655a3b8cf262c4cd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5e1c7d84e9853adddcfde9c35ba53da3c
SHA113ede5de62e09bc84f2f152f43989937ad71e8fc
SHA256c9817f575468cf819c36e58d36c8ca596faa70d26bb0af5ba9f57214df106bc4
SHA51257488711d5beb550d9b2ac83d413b14cb76009a36a85328684067150d44db799ebc1a1236ab9aa4e99e5f8ea71bf0342b9899302dd498ae6ca739896f6715b14
-
Filesize
1.4MB
MD5a8cf5621811f7fac55cfe8cb3fa6b9f6
SHA1121356839e8138a03141f5f5856936a85bd2a474
SHA256614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c
SHA5124479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd
-
Filesize
3.1MB
MD5ed3fa7460523c5ec9d4568e754624405
SHA188ad04cf36c7fe20644d48572ec2e70569c9581b
SHA256d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c
SHA5124ff0b5009effb0630cb3cd5dcd7291bc645cb2d59d1975eaef2cec17f379e00317c44de5ed4b07ec607745571521fff380acbfb98afe3710e5ec2dae36bd1add