Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 04:15
Static task
static1
Behavioral task
behavioral1
Sample
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe
Resource
win10v2004-20240226-en
General
-
Target
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe
-
Size
959KB
-
MD5
de7842054652843bb0ad6b22b5d027ac
-
SHA1
40c64082e19e9fff71ca827325b16f6a724afb8a
-
SHA256
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433
-
SHA512
461639bc7ad84ffaa91585664d726a75cb5e7eb383b74d19547269f1f4f7126265650410fd7cd5ad248be43d91769ef79083b4f05baa84805773c101ba8983c1
-
SSDEEP
24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdyF:Ujrc2So1Ff+B3k7960
Malware Config
Extracted
C:\Program Files\dotnet\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Extracted
C:\Users\Admin\Desktop\LockBit_Ransomware.hta
https://decoding.at/
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion/or
https://decoding.at
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
OfficeC2RClient.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE is not expected to spawn this process 4848 5040 OfficeC2RClient.exe ONENOTE.EXE -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 1560 bcdedit.exe 3248 bcdedit.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{01941949-AFAF-1ED7-3EE1-3E0527C78F12} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe\"" 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\Users\\Admin\\Desktop\\LockBit_Ransomware.hta" 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exedescription ioc process File opened (read-only) \??\F: 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe -
Drops file in System32 directory 6 IoCs
Processes:
printfilterpipelinesvc.exe7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\PPg_r702oooahhfg1pgs39aphib.TMP printfilterpipelinesvc.exe File created C:\windows\SysWOW64\F1941B.ico 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\Windows\system32\spool\PRINTERS\00003.SPL 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\Windows\system32\spool\PRINTERS\PPh0sxoprfz7q4qujivbp0ijc8d.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPhl_modclatjvwig_ek282h0x.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D1A.tmp.bmp" 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
Processes:
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exepid process 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe -
Drops file in Program Files directory 64 IoCs
Processes:
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exedescription ioc process File opened for modification C:\program files\microsoft office\root\licenses16\o365proplusr_subtrial4-pl.xrm-ms 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\themes\dark\searchemail2x.png 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\root\licenses16\projectpro2019vl_mak_ae-pl.xrm-ms 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\videolan\vlc\lua\playlist\twitch.luac 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\js\nls\hr-hr\ui-strings.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\root\licenses16\accessvl_mak-ppd.xrm-ms 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\js\nls\fr-ma\ui-strings.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\themeless\inline-error-1x.png 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\core_icons.png 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\themes\dark\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\ui-strings.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\js\nls\zh-cn\ui-strings.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\scan-files\images\themeless\playstore\ro_get.svg 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\root\licenses16\excelr_oem_perp-ul-phn.xrm-ms 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\videolan\vlc\locale\lg\lc_messages\vlc.mo 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\sv-se\ui-strings.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\zh-tw\ui-strings.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\reviews\js\selector.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\root\licenses16\professionalr_trial-ul-oob.xrm-ms 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account-select\js\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\java\jdk-1.8\lib\packager.jar 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\root\licenses16\proplus2019msdnr_retail-ppd.xrm-ms 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\js\nls\eu-es\ui-strings.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\sign-services-auth\js\nls\eu-es\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\themes\dark\adobe_logo.png 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\root\office16\logoimages\onenotelogo.contrast-black_scale-100.png 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\root\office16\sdxs\fa000000027\assets\icons\send2fluent.png 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\ui-strings.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files\js\nls\nb-no\ui-strings.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140\cartridges\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\7-zip\lang\bn.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\root\licenses16\projectstdco365r_subscription-pl.xrm-ms 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\videolan\vlc\new_skins.url 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\reviews\images\nub.png 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\sk-sk\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\resource\font\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\scan-files\images\themeless\appstore\download_on_the_app_store_badge_sv_135x40.svg 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\java\jre-1.8\lib\images\cursors\win32_copydrop32x32.gif 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\root\licenses16\skypeforbusiness2019vl_mak_ae-ppd.xrm-ms 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\search-summary\js\nls\ru-ru\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-selector.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\packagemanifests\appxmanifest.common.16.xml 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\root\office16\sdxs\fa000000027\assets\icons\cancelglyph.16.grayf.png 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\fr-ma\ui-strings.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\search-summary\js\nls\pt-br\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\uithemes\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\app-center\js\nls\ca-es\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\css\main-selector.css 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\walk-through\images\themeless\s_thumbupoutline_22_n1.svg 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\css\main-selector.css 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\zdingbat.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\java\jre-1.8\lib\security\java.security 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140\cartridges\sql70.xsl 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files\java\jre-1.8\lib\security\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files\js\nls\da-dk\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\js\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons__retina_hicontrast_wob.png 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\js\nls\hr-hr\ui-strings.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\reviews\js\nls\zh-tw\Restore-My-Files.txt 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\images\themes\dark\s_checkbox_selected_18.svg 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\cs-cz\ui-strings.js 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe File opened for modification C:\program files\microsoft office\root\office16\addins\powerpivot excel add-in\cartridges\sql70.xsl 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5004 1512 WerFault.exe mshta.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4664 vssadmin.exe -
Modifies Control Panel 2 IoCs
Processes:
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\WallpaperStyle = "2" 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\TileWallpaper = "0" 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe -
Modifies registry class 15 IoCs
Processes:
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exedescription ioc process Key created \Registry\Machine\Software\Classes\Lockbit\DefaultIcon 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Key created \Registry\Machine\Software\Classes\.lockbit 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\F1941B.ico" 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Key created \Registry\Machine\Software\Classes\Lockbit 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Key created \Registry\Machine\Software\Classes\Lockbit\shell\Open 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lockbit\shell\Open\Command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"C:\\Users\\Admin\\Desktop\\LockBit_Ransomware.hta\"" 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon\ = "C:\\windows\\SysWow64\\F1941B.ico" 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\ = "LockBit" 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lockbit\ = "LockBit Class" 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\F1941B.ico" 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Key created \Registry\Machine\Software\Classes\Lockbit\shell 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Key created \Registry\Machine\Software\Classes\Lockbit\shell\Open\Command 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Key created \Registry\Machine\Software\Classes\htafile\DefaultIcon 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exepid process 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exevssvc.exeWMIC.exedescription pid process Token: SeTakeOwnershipPrivilege 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Token: SeDebugPrivilege 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe Token: SeBackupPrivilege 4276 vssvc.exe Token: SeRestorePrivilege 4276 vssvc.exe Token: SeAuditPrivilege 4276 vssvc.exe Token: SeIncreaseQuotaPrivilege 1688 WMIC.exe Token: SeSecurityPrivilege 1688 WMIC.exe Token: SeTakeOwnershipPrivilege 1688 WMIC.exe Token: SeLoadDriverPrivilege 1688 WMIC.exe Token: SeSystemProfilePrivilege 1688 WMIC.exe Token: SeSystemtimePrivilege 1688 WMIC.exe Token: SeProfSingleProcessPrivilege 1688 WMIC.exe Token: SeIncBasePriorityPrivilege 1688 WMIC.exe Token: SeCreatePagefilePrivilege 1688 WMIC.exe Token: SeBackupPrivilege 1688 WMIC.exe Token: SeRestorePrivilege 1688 WMIC.exe Token: SeShutdownPrivilege 1688 WMIC.exe Token: SeDebugPrivilege 1688 WMIC.exe Token: SeSystemEnvironmentPrivilege 1688 WMIC.exe Token: SeRemoteShutdownPrivilege 1688 WMIC.exe Token: SeUndockPrivilege 1688 WMIC.exe Token: SeManageVolumePrivilege 1688 WMIC.exe Token: 33 1688 WMIC.exe Token: 34 1688 WMIC.exe Token: 35 1688 WMIC.exe Token: 36 1688 WMIC.exe Token: SeIncreaseQuotaPrivilege 1688 WMIC.exe Token: SeSecurityPrivilege 1688 WMIC.exe Token: SeTakeOwnershipPrivilege 1688 WMIC.exe Token: SeLoadDriverPrivilege 1688 WMIC.exe Token: SeSystemProfilePrivilege 1688 WMIC.exe Token: SeSystemtimePrivilege 1688 WMIC.exe Token: SeProfSingleProcessPrivilege 1688 WMIC.exe Token: SeIncBasePriorityPrivilege 1688 WMIC.exe Token: SeCreatePagefilePrivilege 1688 WMIC.exe Token: SeBackupPrivilege 1688 WMIC.exe Token: SeRestorePrivilege 1688 WMIC.exe Token: SeShutdownPrivilege 1688 WMIC.exe Token: SeDebugPrivilege 1688 WMIC.exe Token: SeSystemEnvironmentPrivilege 1688 WMIC.exe Token: SeRemoteShutdownPrivilege 1688 WMIC.exe Token: SeUndockPrivilege 1688 WMIC.exe Token: SeManageVolumePrivilege 1688 WMIC.exe Token: 33 1688 WMIC.exe Token: 34 1688 WMIC.exe Token: 35 1688 WMIC.exe Token: 36 1688 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OfficeC2RClient.exepid process 4848 OfficeC2RClient.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.execmd.exeprintfilterpipelinesvc.exeONENOTE.EXEcmd.exedescription pid process target process PID 1740 wrote to memory of 4780 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe cmd.exe PID 1740 wrote to memory of 4780 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe cmd.exe PID 4780 wrote to memory of 4664 4780 cmd.exe vssadmin.exe PID 4780 wrote to memory of 4664 4780 cmd.exe vssadmin.exe PID 4780 wrote to memory of 1688 4780 cmd.exe WMIC.exe PID 4780 wrote to memory of 1688 4780 cmd.exe WMIC.exe PID 4780 wrote to memory of 1560 4780 cmd.exe bcdedit.exe PID 4780 wrote to memory of 1560 4780 cmd.exe bcdedit.exe PID 4780 wrote to memory of 3248 4780 cmd.exe bcdedit.exe PID 4780 wrote to memory of 3248 4780 cmd.exe bcdedit.exe PID 1648 wrote to memory of 5040 1648 printfilterpipelinesvc.exe ONENOTE.EXE PID 1648 wrote to memory of 5040 1648 printfilterpipelinesvc.exe ONENOTE.EXE PID 5040 wrote to memory of 4848 5040 ONENOTE.EXE OfficeC2RClient.exe PID 5040 wrote to memory of 4848 5040 ONENOTE.EXE OfficeC2RClient.exe PID 1740 wrote to memory of 1512 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe mshta.exe PID 1740 wrote to memory of 1512 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe mshta.exe PID 1740 wrote to memory of 1512 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe mshta.exe PID 1740 wrote to memory of 4856 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe cmd.exe PID 1740 wrote to memory of 4856 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe cmd.exe PID 1740 wrote to memory of 4856 1740 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe cmd.exe PID 4856 wrote to memory of 2300 4856 cmd.exe PING.EXE PID 4856 wrote to memory of 2300 4856 cmd.exe PING.EXE PID 4856 wrote to memory of 2300 4856 cmd.exe PING.EXE PID 4856 wrote to memory of 2108 4856 cmd.exe fsutil.exe PID 4856 wrote to memory of 2108 4856 cmd.exe fsutil.exe PID 4856 wrote to memory of 2108 4856 cmd.exe fsutil.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe"C:\Users\Admin\AppData\Local\Temp\7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4664
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1560
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:3248
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit_Ransomware.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:1512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 17963⤵
- Program crash
PID:5004
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:2300
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433.exe"3⤵PID:2108
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3496
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{2927B083-61FB-4856-BA03-BF09C060B7A9}.xps" 1335486335002900002⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exeOfficeC2RClient.exe /error PID=5040 ProcessName="Microsoft OneNote" UIType=3 ErrorSource=0x8b10082a ErrorCode=0x80004005 ShowUI=13⤵
- Process spawned unexpected child process
- Suspicious use of SetWindowsHookEx
PID:4848
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1512 -ip 15121⤵PID:4972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5fc8136f820b57881f774d78fd4d766c4
SHA1a6cef5cd098ef3406587601fdb3a10a5cc04f61b
SHA25617bf5638b7ac63580284ef62a96cdcd636b5069ad4841947dd4a2d15875e141a
SHA51227f8e08aa700d99feb731ab2cded9daa1690bcb5f86c4e9e6c7c8a417e023f0c6fbbf7a46f2a192c4d06bbc236e2852062da234eace0dce8a061fd9242243a73
-
Filesize
46KB
MD5c15c6adc8c923ad87981f289025c37b2
SHA1bfe6533f4afe3255046f7178f289a4c75ad89e76
SHA25690f3a33919fdd766e90fd96f8f20a92c2d1376b7cfdc8b738c2f8e7e6c7498b1
SHA51231dd03b208e00ac012fbe4189d5af1306cc8e3640d40efefab4aa1cabab3c4735eef0cb65e7750c3c77021934e145398e5e26389975cf36b193c8f622a5fde83