Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25-07-2024 01:44
Static task
static1
Behavioral task
behavioral1
Sample
LisectAVT_2403002C_161.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
LisectAVT_2403002C_161.exe
Resource
win10v2004-20240709-en
General
-
Target
LisectAVT_2403002C_161.exe
-
Size
74KB
-
MD5
d347769098a8697660804d68eaac0622
-
SHA1
e2758e6c0751c30849614728a63aeb9e82ea3113
-
SHA256
f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800
-
SHA512
b4874af4ffd16bce8682f6ecedc5f2dd4ec0ebd34af438f760e3aeeefef55e6cb634598f9edbe5e829cdbb4e3e701f11f0890faaee43a669b081b0f74acc34aa
-
SSDEEP
1536:mNeRBl5PT/rx1mzwRMSTdLpJPgEEt4AwMEz9UQzdbGCq2iW7z:mQRrmzwR5Jw45MEyQ5GCH
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span>
class='mark'>[email protected]</span>
class='mark'>[email protected]</span>
http://www.w3.org/TR/html4/strict.dtd'>
https://pidgin.im/download/windows/</li>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 2180 bcdedit.exe 108 bcdedit.exe 2152 bcdedit.exe 2780 bcdedit.exe -
Renames multiple (313) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exewbadmin.exepid process 1600 wbadmin.exe 1808 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 1608 netsh.exe 1228 netsh.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\zGrw.exe aspack_v212_v242 -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 3 IoCs
Processes:
LisectAVT_2403002C_161.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\LisectAVT_2403002C_161.exe LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini LisectAVT_2403002C_161.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe -
Executes dropped EXE 1 IoCs
Processes:
zGrw.exepid process 2116 zGrw.exe -
Loads dropped DLL 2 IoCs
Processes:
LisectAVT_2403002C_161.exepid process 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
LisectAVT_2403002C_161.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LisectAVT_2403002C_161 = "C:\\Users\\Admin\\AppData\\Local\\LisectAVT_2403002C_161.exe" LisectAVT_2403002C_161.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\LisectAVT_2403002C_161 = "C:\\Users\\Admin\\AppData\\Local\\LisectAVT_2403002C_161.exe" LisectAVT_2403002C_161.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
LisectAVT_2403002C_161.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Public\Desktop\desktop.ini LisectAVT_2403002C_161.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Public\Pictures\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84790KOV\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\Documents\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Public\Libraries\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BRLV7L3G\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\Searches\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Public\Music\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\48RNM7SN\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JF1SL0MP\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Public\Documents\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\3CPCT0UC\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XW1885AL\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\Videos\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Public\Videos\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini LisectAVT_2403002C_161.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini LisectAVT_2403002C_161.exe -
Drops file in Program Files directory 64 IoCs
Processes:
LisectAVT_2403002C_161.exezGrw.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\BUTTON.GIF LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\de-DE\Sidebar.exe.mui LisectAVT_2403002C_161.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Kiev LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\OMSINTL.DLL.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Common Files\System\ado\msador15.dll LisectAVT_2403002C_161.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\blank.png LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\settings.html LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_cloudy.png LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll LisectAVT_2403002C_161.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02384_.WMF LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR47F.GIF.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\AddToViewArrow.jpg LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONFLICT.ICO.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png LisectAVT_2403002C_161.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00319_.WMF.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_06.MID.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\PROCDB.XLAM.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\TYPE.WAV.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\glow.png LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe zGrw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\management.dll LisectAVT_2403002C_161.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo LisectAVT_2403002C_161.exe File created C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\gadget.xml LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387337.JPG LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe zGrw.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPreviewTemplate.html.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewFrame.html.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_zh-TW.dll.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01247U.BMP.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00736_.WMF LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\COUPON.POC.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME17.CSS.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml LisectAVT_2403002C_161.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby LisectAVT_2403002C_161.exe File created C:\Program Files\Mozilla Firefox\defaultagent.ini.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02398_.WMF LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115839.GIF LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\TAB_OFF.GIF LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV.HXS.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\SBCGLOBAL.NET.XML.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File created C:\Program Files\7-Zip\Lang\nn.txt.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384862.JPG LisectAVT_2403002C_161.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02862_.WMF LisectAVT_2403002C_161.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02074_.GIF.id[DECBBE77-3542].[[email protected]].faust LisectAVT_2403002C_161.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
zGrw.execmd.exemshta.exemshta.exemshta.exemshta.exeLisectAVT_2403002C_161.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zGrw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LisectAVT_2403002C_161.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2956 vssadmin.exe 2732 vssadmin.exe -
Processes:
mshta.exemshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
LisectAVT_2403002C_161.exepid process 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe 2384 LisectAVT_2403002C_161.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
LisectAVT_2403002C_161.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 2384 LisectAVT_2403002C_161.exe Token: SeBackupPrivilege 1784 vssvc.exe Token: SeRestorePrivilege 1784 vssvc.exe Token: SeAuditPrivilege 1784 vssvc.exe Token: SeIncreaseQuotaPrivilege 2580 WMIC.exe Token: SeSecurityPrivilege 2580 WMIC.exe Token: SeTakeOwnershipPrivilege 2580 WMIC.exe Token: SeLoadDriverPrivilege 2580 WMIC.exe Token: SeSystemProfilePrivilege 2580 WMIC.exe Token: SeSystemtimePrivilege 2580 WMIC.exe Token: SeProfSingleProcessPrivilege 2580 WMIC.exe Token: SeIncBasePriorityPrivilege 2580 WMIC.exe Token: SeCreatePagefilePrivilege 2580 WMIC.exe Token: SeBackupPrivilege 2580 WMIC.exe Token: SeRestorePrivilege 2580 WMIC.exe Token: SeShutdownPrivilege 2580 WMIC.exe Token: SeDebugPrivilege 2580 WMIC.exe Token: SeSystemEnvironmentPrivilege 2580 WMIC.exe Token: SeRemoteShutdownPrivilege 2580 WMIC.exe Token: SeUndockPrivilege 2580 WMIC.exe Token: SeManageVolumePrivilege 2580 WMIC.exe Token: 33 2580 WMIC.exe Token: 34 2580 WMIC.exe Token: 35 2580 WMIC.exe Token: SeIncreaseQuotaPrivilege 2580 WMIC.exe Token: SeSecurityPrivilege 2580 WMIC.exe Token: SeTakeOwnershipPrivilege 2580 WMIC.exe Token: SeLoadDriverPrivilege 2580 WMIC.exe Token: SeSystemProfilePrivilege 2580 WMIC.exe Token: SeSystemtimePrivilege 2580 WMIC.exe Token: SeProfSingleProcessPrivilege 2580 WMIC.exe Token: SeIncBasePriorityPrivilege 2580 WMIC.exe Token: SeCreatePagefilePrivilege 2580 WMIC.exe Token: SeBackupPrivilege 2580 WMIC.exe Token: SeRestorePrivilege 2580 WMIC.exe Token: SeShutdownPrivilege 2580 WMIC.exe Token: SeDebugPrivilege 2580 WMIC.exe Token: SeSystemEnvironmentPrivilege 2580 WMIC.exe Token: SeRemoteShutdownPrivilege 2580 WMIC.exe Token: SeUndockPrivilege 2580 WMIC.exe Token: SeManageVolumePrivilege 2580 WMIC.exe Token: 33 2580 WMIC.exe Token: 34 2580 WMIC.exe Token: 35 2580 WMIC.exe Token: SeBackupPrivilege 1596 wbengine.exe Token: SeRestorePrivilege 1596 wbengine.exe Token: SeSecurityPrivilege 1596 wbengine.exe Token: SeIncreaseQuotaPrivilege 2656 WMIC.exe Token: SeSecurityPrivilege 2656 WMIC.exe Token: SeTakeOwnershipPrivilege 2656 WMIC.exe Token: SeLoadDriverPrivilege 2656 WMIC.exe Token: SeSystemProfilePrivilege 2656 WMIC.exe Token: SeSystemtimePrivilege 2656 WMIC.exe Token: SeProfSingleProcessPrivilege 2656 WMIC.exe Token: SeIncBasePriorityPrivilege 2656 WMIC.exe Token: SeCreatePagefilePrivilege 2656 WMIC.exe Token: SeBackupPrivilege 2656 WMIC.exe Token: SeRestorePrivilege 2656 WMIC.exe Token: SeShutdownPrivilege 2656 WMIC.exe Token: SeDebugPrivilege 2656 WMIC.exe Token: SeSystemEnvironmentPrivilege 2656 WMIC.exe Token: SeRemoteShutdownPrivilege 2656 WMIC.exe Token: SeUndockPrivilege 2656 WMIC.exe Token: SeManageVolumePrivilege 2656 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
LisectAVT_2403002C_161.exezGrw.execmd.execmd.execmd.exedescription pid process target process PID 2384 wrote to memory of 2116 2384 LisectAVT_2403002C_161.exe zGrw.exe PID 2384 wrote to memory of 2116 2384 LisectAVT_2403002C_161.exe zGrw.exe PID 2384 wrote to memory of 2116 2384 LisectAVT_2403002C_161.exe zGrw.exe PID 2384 wrote to memory of 2116 2384 LisectAVT_2403002C_161.exe zGrw.exe PID 2116 wrote to memory of 2612 2116 zGrw.exe cmd.exe PID 2116 wrote to memory of 2612 2116 zGrw.exe cmd.exe PID 2116 wrote to memory of 2612 2116 zGrw.exe cmd.exe PID 2116 wrote to memory of 2612 2116 zGrw.exe cmd.exe PID 2384 wrote to memory of 656 2384 LisectAVT_2403002C_161.exe cmd.exe PID 2384 wrote to memory of 656 2384 LisectAVT_2403002C_161.exe cmd.exe PID 2384 wrote to memory of 656 2384 LisectAVT_2403002C_161.exe cmd.exe PID 2384 wrote to memory of 656 2384 LisectAVT_2403002C_161.exe cmd.exe PID 2384 wrote to memory of 680 2384 LisectAVT_2403002C_161.exe cmd.exe PID 2384 wrote to memory of 680 2384 LisectAVT_2403002C_161.exe cmd.exe PID 2384 wrote to memory of 680 2384 LisectAVT_2403002C_161.exe cmd.exe PID 2384 wrote to memory of 680 2384 LisectAVT_2403002C_161.exe cmd.exe PID 656 wrote to memory of 1608 656 cmd.exe netsh.exe PID 656 wrote to memory of 1608 656 cmd.exe netsh.exe PID 656 wrote to memory of 1608 656 cmd.exe netsh.exe PID 680 wrote to memory of 2956 680 cmd.exe vssadmin.exe PID 680 wrote to memory of 2956 680 cmd.exe vssadmin.exe PID 680 wrote to memory of 2956 680 cmd.exe vssadmin.exe PID 656 wrote to memory of 1228 656 cmd.exe netsh.exe PID 656 wrote to memory of 1228 656 cmd.exe netsh.exe PID 656 wrote to memory of 1228 656 cmd.exe netsh.exe PID 680 wrote to memory of 2580 680 cmd.exe WMIC.exe PID 680 wrote to memory of 2580 680 cmd.exe WMIC.exe PID 680 wrote to memory of 2580 680 cmd.exe WMIC.exe PID 680 wrote to memory of 2180 680 cmd.exe bcdedit.exe PID 680 wrote to memory of 2180 680 cmd.exe bcdedit.exe PID 680 wrote to memory of 2180 680 cmd.exe bcdedit.exe PID 680 wrote to memory of 108 680 cmd.exe bcdedit.exe PID 680 wrote to memory of 108 680 cmd.exe bcdedit.exe PID 680 wrote to memory of 108 680 cmd.exe bcdedit.exe PID 680 wrote to memory of 1600 680 cmd.exe wbadmin.exe PID 680 wrote to memory of 1600 680 cmd.exe wbadmin.exe PID 680 wrote to memory of 1600 680 cmd.exe wbadmin.exe PID 2384 wrote to memory of 2264 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2264 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2264 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2264 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2108 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2108 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2108 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2108 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2032 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2032 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2032 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2032 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2036 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2036 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2036 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 2036 2384 LisectAVT_2403002C_161.exe mshta.exe PID 2384 wrote to memory of 1608 2384 LisectAVT_2403002C_161.exe cmd.exe PID 2384 wrote to memory of 1608 2384 LisectAVT_2403002C_161.exe cmd.exe PID 2384 wrote to memory of 1608 2384 LisectAVT_2403002C_161.exe cmd.exe PID 2384 wrote to memory of 1608 2384 LisectAVT_2403002C_161.exe cmd.exe PID 1608 wrote to memory of 2732 1608 cmd.exe vssadmin.exe PID 1608 wrote to memory of 2732 1608 cmd.exe vssadmin.exe PID 1608 wrote to memory of 2732 1608 cmd.exe vssadmin.exe PID 1608 wrote to memory of 2656 1608 cmd.exe WMIC.exe PID 1608 wrote to memory of 2656 1608 cmd.exe WMIC.exe PID 1608 wrote to memory of 2656 1608 cmd.exe WMIC.exe PID 1608 wrote to memory of 2152 1608 cmd.exe bcdedit.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_161.exe"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_161.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\zGrw.exeC:\Users\Admin\AppData\Local\Temp\zGrw.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\2cf67ce1.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2612
-
-
-
C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_161.exe"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_161.exe"2⤵PID:2016
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2956
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2180
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:108
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1600
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1608
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1228
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2264
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2108
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2032
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2036
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2732
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2152
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2780
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1808
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2676
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1992
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
MD543dd2d07eaa8fb655d14f1b1e6d3dad1
SHA1635bcc8bba0e2989485436fe304be02593858478
SHA256aac2c34317320ce0bdf49bb3267b2ac60ec25283a3e3f45518a6535c738a851f
SHA51278df3d402d35f5f7874a20e1d93508084c068dfb5186079d6bc2917078c480405537963b702d04d08c44dad3c1bbbf9f4bd8a8446d624504a9062735119ed204
-
Filesize
31KB
MD5ff66541f8880814a3e1c3d8de6fb619b
SHA16950a7f2dd847a3132ef3dd1b1d173b820651448
SHA2566a0ff93635853a719657b3f25da01b5d98b3ea4d6c36af408acb9824385532fa
SHA51227717e305562262ded61ae5e24cc0a44cc20b3cd5a9ce825e12bb4b6eebdc6bbc3d7d2a1757c75419602e049ca0dfd3c880a865c70582beee6109c77c80a36f5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5\k2[1].rar
Filesize4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
183B
MD510c3436aa833ba2af9afda17dca629c9
SHA161a195d514bda98af79e1e7c083dee502872419f
SHA2565a143929918fd32de0a9c3ff7be309aef644a32e0d13a3fbd7fbe20a08a6a5c7
SHA512e3e6afa8131761535f34725ca88b9022000596a0b37ee08e1bb9f73188df77519fae2286961090816bde7762390e01dc9a7f8c826cbdd1ff2022d822165b6a17
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
15KB
MD5f7d21de5c4e81341eccd280c11ddcc9a
SHA1d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA2564485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3
-
Filesize
6KB
MD5d87de810d19b026c4875454f63eca017
SHA1c94c524ef6e725447d4e4d3a049c5c7b249ce80f
SHA2565b0b963693300be2a0bcaf69ea637a12cfa98f05eb5b7bbaa818a447f13faa7d
SHA5120a228bfa0adb564ab82910417d6e5f8dde0053ed8d6051bd671e56dd331a2dc8ecfbf2d5a6ce992cf2d7ccff47ea081c386878bdf48aaa7d63541abc29eb0ff2