Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
31.bin/1.exe
windows7-x64
101.bin/1.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102b5e50bc30...ba.dll
windows7-x64
102b5e50bc30...ba.dll
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
102c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
13DMark 11 ...on.exe
windows10-2004-x64
142f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
1042f9729255...1).exe
windows7-x64
1042f9729255...1).exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
769c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
106a9e7107c9...91.exe
windows7-x64
106a9e7107c9...91.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
195560f1a46...f9.dll
windows10-2004-x64
5Resubmissions
03-07-2024 16:04
240703-thygmaycpc 1001-07-2024 18:12
240701-ws6xvswbkj 1001-07-2024 18:03
240701-wm5sls1gka 1001-07-2024 18:03
240701-wm39sa1gjf 1001-07-2024 18:03
240701-wm2e7avhkj 1001-07-2024 18:03
240701-wmzxcs1fre 1001-07-2024 18:02
240701-wmzats1frc 1001-07-2024 18:02
240701-wmvbwa1fqh 1022-11-2023 17:02
231122-vkac9adg64 10Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 18:03
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
1.bin/1.exe
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
1.bin/1.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
31.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
31.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20240419-en
Behavioral task
behavioral22
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20240611-en
Behavioral task
behavioral28
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20240508-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3892 sc.exe 1044 sc.exe 3248 sc.exe 4564 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 47 IoCs
pid Process 1772 taskkill.exe 1360 taskkill.exe 2928 taskkill.exe 3104 taskkill.exe 4964 taskkill.exe 3236 taskkill.exe 3796 taskkill.exe 2536 taskkill.exe 5036 taskkill.exe 3228 taskkill.exe 2344 taskkill.exe 760 taskkill.exe 2756 taskkill.exe 1320 taskkill.exe 2316 taskkill.exe 2904 taskkill.exe 4436 taskkill.exe 4508 taskkill.exe 1464 taskkill.exe 1260 taskkill.exe 4544 taskkill.exe 1356 taskkill.exe 3020 taskkill.exe 4988 taskkill.exe 4624 taskkill.exe 372 taskkill.exe 1560 taskkill.exe 4820 taskkill.exe 3376 taskkill.exe 4996 taskkill.exe 1828 taskkill.exe 932 taskkill.exe 1572 taskkill.exe 2896 taskkill.exe 2420 taskkill.exe 3860 taskkill.exe 2664 taskkill.exe 3828 taskkill.exe 3252 taskkill.exe 668 taskkill.exe 1988 taskkill.exe 4512 taskkill.exe 464 taskkill.exe 4136 taskkill.exe 2324 taskkill.exe 5064 taskkill.exe 3044 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2840 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 6784 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 3860 taskkill.exe Token: SeDebugPrivilege 4544 taskkill.exe Token: SeDebugPrivilege 5064 taskkill.exe Token: SeDebugPrivilege 3796 taskkill.exe Token: SeDebugPrivilege 2316 taskkill.exe Token: SeDebugPrivilege 1320 taskkill.exe Token: SeDebugPrivilege 2756 taskkill.exe Token: SeDebugPrivilege 1356 taskkill.exe Token: SeDebugPrivilege 2324 taskkill.exe Token: SeDebugPrivilege 3044 taskkill.exe Token: SeDebugPrivilege 2664 taskkill.exe Token: SeDebugPrivilege 5036 taskkill.exe Token: SeDebugPrivilege 2536 taskkill.exe Token: SeDebugPrivilege 668 taskkill.exe Token: SeDebugPrivilege 1572 taskkill.exe Token: SeDebugPrivilege 2896 taskkill.exe Token: SeDebugPrivilege 4512 taskkill.exe Token: SeDebugPrivilege 4624 taskkill.exe Token: SeDebugPrivilege 4964 taskkill.exe Token: SeDebugPrivilege 1260 taskkill.exe Token: SeDebugPrivilege 1464 taskkill.exe Token: SeDebugPrivilege 372 taskkill.exe Token: SeDebugPrivilege 3252 taskkill.exe Token: SeDebugPrivilege 4996 taskkill.exe Token: SeDebugPrivilege 932 taskkill.exe Token: SeDebugPrivilege 4136 taskkill.exe Token: SeDebugPrivilege 4508 taskkill.exe Token: SeDebugPrivilege 1772 taskkill.exe Token: SeDebugPrivilege 1360 taskkill.exe Token: SeDebugPrivilege 2420 taskkill.exe Token: SeDebugPrivilege 3104 taskkill.exe Token: SeDebugPrivilege 2904 taskkill.exe Token: SeDebugPrivilege 3228 taskkill.exe Token: SeDebugPrivilege 1560 taskkill.exe Token: SeDebugPrivilege 2928 taskkill.exe Token: SeDebugPrivilege 760 taskkill.exe Token: SeDebugPrivilege 3376 taskkill.exe Token: SeDebugPrivilege 2344 taskkill.exe Token: SeDebugPrivilege 4988 taskkill.exe Token: SeDebugPrivilege 464 taskkill.exe Token: SeDebugPrivilege 3712 powershell.exe Token: SeDebugPrivilege 3236 taskkill.exe Token: SeDebugPrivilege 3020 taskkill.exe Token: SeDebugPrivilege 4436 taskkill.exe Token: SeDebugPrivilege 4820 taskkill.exe Token: SeDebugPrivilege 1988 taskkill.exe Token: SeDebugPrivilege 3828 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 3892 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 83 PID 2300 wrote to memory of 3892 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 83 PID 2300 wrote to memory of 3456 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 84 PID 2300 wrote to memory of 3456 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 84 PID 2300 wrote to memory of 4564 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 2300 wrote to memory of 4564 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 2300 wrote to memory of 3248 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 2300 wrote to memory of 3248 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 2300 wrote to memory of 1044 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 2300 wrote to memory of 1044 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 2300 wrote to memory of 2664 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 2300 wrote to memory of 2664 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 2300 wrote to memory of 3860 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 2300 wrote to memory of 3860 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 2300 wrote to memory of 2324 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 2300 wrote to memory of 2324 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 2300 wrote to memory of 5036 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 2300 wrote to memory of 5036 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 2300 wrote to memory of 2316 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 2300 wrote to memory of 2316 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 2300 wrote to memory of 4544 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 2300 wrote to memory of 4544 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 2300 wrote to memory of 3044 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 2300 wrote to memory of 3044 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 2300 wrote to memory of 5064 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 2300 wrote to memory of 5064 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 2300 wrote to memory of 3796 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 2300 wrote to memory of 3796 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 2300 wrote to memory of 2896 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 2300 wrote to memory of 2896 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 2300 wrote to memory of 1356 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 2300 wrote to memory of 1356 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 2300 wrote to memory of 1320 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 2300 wrote to memory of 1320 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 2300 wrote to memory of 668 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 2300 wrote to memory of 668 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 2300 wrote to memory of 1572 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 2300 wrote to memory of 1572 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 2300 wrote to memory of 2756 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 2300 wrote to memory of 2756 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 2300 wrote to memory of 2904 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 2300 wrote to memory of 2904 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 2300 wrote to memory of 2536 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 2300 wrote to memory of 2536 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 2300 wrote to memory of 464 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 123 PID 2300 wrote to memory of 464 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 123 PID 2300 wrote to memory of 760 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 127 PID 2300 wrote to memory of 760 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 127 PID 2300 wrote to memory of 932 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 128 PID 2300 wrote to memory of 932 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 128 PID 2300 wrote to memory of 1828 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 2300 wrote to memory of 1828 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 2300 wrote to memory of 3236 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 130 PID 2300 wrote to memory of 3236 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 130 PID 2300 wrote to memory of 1260 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 131 PID 2300 wrote to memory of 1260 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 131 PID 2300 wrote to memory of 372 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 132 PID 2300 wrote to memory of 372 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 132 PID 2300 wrote to memory of 4624 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 133 PID 2300 wrote to memory of 4624 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 133 PID 2300 wrote to memory of 4512 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 134 PID 2300 wrote to memory of 4512 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 134 PID 2300 wrote to memory of 3252 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 135 PID 2300 wrote to memory of 3252 2300 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 135
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:3892
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:3456
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:4564
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:3248
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:1044
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3796
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:668
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:464
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:932
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:1828
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3236
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:372
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3252
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4964
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3104
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3828
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:2840
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵PID:2844
-
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:6784
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:5612
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:1572
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:5632
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD590ca1949dac7b9a15dc8187887728b5d
SHA14ef926c62e8352696d8b315a43ef574df19ff16d
SHA2564394ab5761bafda70e8d4b7bac6e0cac9c07478674bf0a3ad7349fbc9edc30a8
SHA512caf65ac557801707939707b8586132e5ed07c711dbc22a668d81062e48a86d9808abb288a0110092136c0499dc7592ebecc4b5f161e96be74c515bd92d49fd02
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD529d90df58d3db3605550270481fb0936
SHA1b3b34749a14b1010f880b311b6c5eb219c501922
SHA25616cd44db056bc527f3669f0b3eef740058f2f589a607a8b3bfaf016ab4644963
SHA512bff5c39a79eac3ca8bc942711313bd2823f347e35147eb08faac9b090cc709424c7444ec56c08535b64e104aa2256992709e5915805e74f671dfa719f46cddf9
-
C:\ProgramData\Package Cache\{2BB73336-4F69-4141-9797-E9BD6FE3980A}v64.8.8795\dotnet-host-8.0.2-win-x64.msi.energy[[email protected]]
Filesize728KB
MD5f1ee80fabd410f75a9ba8bd49f49abc6
SHA1ff38cd23bad275e66c82aa9525068460598a6911
SHA256dd4c7484972645b9b19edb11a14d8ab188b22cb94c375189717b67fa205f759a
SHA512420935987024501c2bcdda4fd6d1b0abb62485ebe824286f7cc97fad9dcd62988a6f5333b9b047b9aaf23b965662b8037e868c9e21ec514e21d055a7328ef88b
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD50f69de06e4b254844728b8f37bec015d
SHA1619eceb6525bcde22ffe567739bd1fadc54b68d9
SHA2561dd0f2317bc4719fd05266e4bf245244966eda8907b8edb5925a45176d60f26a
SHA5129950445c6c3796e439f05e64da0f55ecb8afe890d59c19942fdf72c1a7288bf1a74f632d9bb5a3c8559b537ab3bebb3cf38e036bf7b2a087cbea8a5a760a322c
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD50042f127ca1b8211a50ee4791c06ee04
SHA1aa1f06eefe0dfea8832eca1059f33b002f85be49
SHA256a84897a54acfbf567d650a75e23425145d73b4ecd048fb023d8eeaecbf49ba09
SHA5122aeab743c0c19b81169a1f777c83d211358f13b83acf4f9b08429036beca68010ddf09c321ed03fd1c1e283e5da9a7b9e4a34bddb85938af4ab1469107145a8f
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD593f7af1116f85e1f22d07dadb31361a1
SHA171c745269afb74c9e3145a76c334d96b5b77f5a0
SHA256acfb2bf51627d19a1bf2c496cae97be2b4391b88ffdf31207d7b013299f6feaa
SHA5126f573e6db1605d56f905dc760e187f764721309ac0da7912c7f275806e04cfc1c20c2a0e0218e5dc487a81b00ab5d16e77b404799fac38b88f98ecc478415307