Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
731.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
103s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2025, 05:35
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250314-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2264 sc.exe 4788 sc.exe 4352 sc.exe 2724 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 7044 cmd.exe 2884 PING.EXE -
Kills process with taskkill 47 IoCs
pid Process 5544 taskkill.exe 4944 taskkill.exe 4180 taskkill.exe 4508 taskkill.exe 4512 taskkill.exe 4448 taskkill.exe 632 taskkill.exe 4480 taskkill.exe 1136 taskkill.exe 5140 taskkill.exe 936 taskkill.exe 3100 taskkill.exe 4676 taskkill.exe 4488 taskkill.exe 1464 taskkill.exe 960 taskkill.exe 3464 taskkill.exe 5192 taskkill.exe 728 taskkill.exe 3228 taskkill.exe 2464 taskkill.exe 4544 taskkill.exe 1880 taskkill.exe 4500 taskkill.exe 4952 taskkill.exe 6032 taskkill.exe 1456 taskkill.exe 4584 taskkill.exe 3820 taskkill.exe 3452 taskkill.exe 1152 taskkill.exe 3716 taskkill.exe 2428 taskkill.exe 5892 taskkill.exe 2224 taskkill.exe 1184 taskkill.exe 4704 taskkill.exe 1436 taskkill.exe 4780 taskkill.exe 4020 taskkill.exe 3268 taskkill.exe 2956 taskkill.exe 2976 taskkill.exe 4728 taskkill.exe 3952 taskkill.exe 3296 taskkill.exe 5868 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 7020 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2884 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 2956 taskkill.exe Token: SeDebugPrivilege 2464 taskkill.exe Token: SeDebugPrivilege 4180 taskkill.exe Token: SeDebugPrivilege 6032 taskkill.exe Token: SeDebugPrivilege 2224 taskkill.exe Token: SeDebugPrivilege 3100 taskkill.exe Token: SeDebugPrivilege 5868 taskkill.exe Token: SeDebugPrivilege 3820 taskkill.exe Token: SeDebugPrivilege 2976 taskkill.exe Token: SeDebugPrivilege 5140 taskkill.exe Token: SeDebugPrivilege 4020 taskkill.exe Token: SeDebugPrivilege 4488 taskkill.exe Token: SeDebugPrivilege 4676 taskkill.exe Token: SeDebugPrivilege 4500 taskkill.exe Token: SeDebugPrivilege 4780 taskkill.exe Token: SeDebugPrivilege 1456 taskkill.exe Token: SeDebugPrivilege 4704 taskkill.exe Token: SeDebugPrivilege 1436 taskkill.exe Token: SeDebugPrivilege 960 taskkill.exe Token: SeDebugPrivilege 1136 taskkill.exe Token: SeDebugPrivilege 3268 taskkill.exe Token: SeDebugPrivilege 5544 taskkill.exe Token: SeDebugPrivilege 5192 taskkill.exe Token: SeDebugPrivilege 3228 taskkill.exe Token: SeDebugPrivilege 3464 taskkill.exe Token: SeDebugPrivilege 2428 taskkill.exe Token: SeDebugPrivilege 4448 taskkill.exe Token: SeDebugPrivilege 4728 taskkill.exe Token: SeDebugPrivilege 1880 taskkill.exe Token: SeDebugPrivilege 728 taskkill.exe Token: SeDebugPrivilege 4952 taskkill.exe Token: SeDebugPrivilege 1464 taskkill.exe Token: SeDebugPrivilege 4508 taskkill.exe Token: SeDebugPrivilege 5892 taskkill.exe Token: SeDebugPrivilege 4944 taskkill.exe Token: SeDebugPrivilege 1184 taskkill.exe Token: SeDebugPrivilege 4544 taskkill.exe Token: SeDebugPrivilege 4584 taskkill.exe Token: SeDebugPrivilege 3452 taskkill.exe Token: SeDebugPrivilege 3716 taskkill.exe Token: SeDebugPrivilege 4592 powershell.exe Token: SeDebugPrivilege 936 taskkill.exe Token: SeDebugPrivilege 3296 taskkill.exe Token: SeDebugPrivilege 3952 taskkill.exe Token: SeDebugPrivilege 4512 taskkill.exe Token: SeDebugPrivilege 4480 taskkill.exe Token: SeDebugPrivilege 632 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5100 wrote to memory of 2724 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 84 PID 5100 wrote to memory of 2724 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 84 PID 5100 wrote to memory of 4352 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 5100 wrote to memory of 4352 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 5100 wrote to memory of 4788 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 5100 wrote to memory of 4788 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 5100 wrote to memory of 2264 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 5100 wrote to memory of 2264 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 5100 wrote to memory of 5140 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 5100 wrote to memory of 5140 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 5100 wrote to memory of 2224 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 5100 wrote to memory of 2224 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 5100 wrote to memory of 4180 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 5100 wrote to memory of 4180 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 5100 wrote to memory of 5892 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 5100 wrote to memory of 5892 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 5100 wrote to memory of 5544 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 5100 wrote to memory of 5544 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 5100 wrote to memory of 1456 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 5100 wrote to memory of 1456 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 5100 wrote to memory of 2976 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 5100 wrote to memory of 2976 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 5100 wrote to memory of 2464 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 5100 wrote to memory of 2464 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 5100 wrote to memory of 2956 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 5100 wrote to memory of 2956 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 5100 wrote to memory of 4988 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 5100 wrote to memory of 4988 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 5100 wrote to memory of 6032 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 5100 wrote to memory of 6032 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 5100 wrote to memory of 3268 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 5100 wrote to memory of 3268 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 5100 wrote to memory of 3228 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 5100 wrote to memory of 3228 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 5100 wrote to memory of 3464 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 5100 wrote to memory of 3464 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 5100 wrote to memory of 4020 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 5100 wrote to memory of 4020 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 5100 wrote to memory of 5868 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 5100 wrote to memory of 5868 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 5100 wrote to memory of 960 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 5100 wrote to memory of 960 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 5100 wrote to memory of 2428 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 5100 wrote to memory of 2428 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 5100 wrote to memory of 3716 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 5100 wrote to memory of 3716 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 5100 wrote to memory of 4780 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 5100 wrote to memory of 4780 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 5100 wrote to memory of 3296 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 5100 wrote to memory of 3296 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 5100 wrote to memory of 1152 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 5100 wrote to memory of 1152 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 5100 wrote to memory of 3952 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 5100 wrote to memory of 3952 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 5100 wrote to memory of 1436 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 5100 wrote to memory of 1436 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 5100 wrote to memory of 728 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 5100 wrote to memory of 728 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 5100 wrote to memory of 4944 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 5100 wrote to memory of 4944 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 5100 wrote to memory of 1464 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 5100 wrote to memory of 1464 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 5100 wrote to memory of 1136 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 123 PID 5100 wrote to memory of 1136 5100 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:2724
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:4352
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:4788
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:2264
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5140
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5892
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5544
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:4988
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6032
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3464
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5868
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:960
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3716
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4780
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:1152
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:728
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4704
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:632
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5192
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:936
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4448
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:7020
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:7044 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2884
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:5540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:7080
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:6208
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5bbde3f62da84b1d9c1bac90ce83261f2
SHA195bb0a048e04c26a592c590104b7dbf29a691ac1
SHA256410a0aaac8738d5cd4a157fa6b9bb708bea468a80bb43a8d4e403b0a8ebc7b78
SHA512692baef1ce1e468cadc21ffb297dfab89e67ab4a8a1a966fead21194e8e50fb326f40c5c7d4df7a809d231520a173f4586d00f1cf61081d7a6d1709f6dff01f6
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD51054fe729e4f50f31a97b0ed0feb6739
SHA1dd8fc9fc595bf81df4ac29b1bc98f225cfd59b48
SHA256c7014c3542dcdfd833ff4b97db8f175431335cb2b4eccfa35dc111c56b28af6a
SHA512a5f218aa5bf4d086fd716b5d2c363aae12af156111f662269ed9115f153544b1e4423802aac81a840e3aa8acfcc7efa0d8a8d53fdba77540b07f8cbf45c6a7d9
-
C:\ProgramData\Package Cache\{2BB73336-4F69-4141-9797-E9BD6FE3980A}v64.8.8795\dotnet-host-8.0.2-win-x64.msi.energy[[email protected]]
Filesize728KB
MD5fc057b0d5fdfd5a945597f3945a6f181
SHA12f5cef3652fa169dab3aa05e41c79a14af71c51f
SHA256af4c7de6848954982ccc830b46ef0a961ff7826ebf0e96b625e88c7094712aca
SHA5120a8dddf286fa5f41bd6e047f5b07118f9dde0ee8e211bbdb7306462d006767e614a2c0d53b42f75c44acff3bc51c0d5244301e7b81ba5a1f136140dceaf099e5
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD54e15dc84a5c5d4a288ca60c82fe203d6
SHA178b10abb3e0ef7ac7be6adf09394b76c15e0a01c
SHA2564fe42e66dd0f05e34774be0a674bc749eb8a5492cf61e09e26507e2f90c9d6ca
SHA5127f1a24ac02e1a94c395e79fa959c79d01c26bae3cea832815932695578638aec16a9287315bba6ca97e108d43a032afcd44602205f70ffd81eb3915682764d57
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD56c651945830457802ebda020d22420f3
SHA12c34d3eb23cf985e97f1645a965e15e3120f3b68
SHA25629faad5b5accd0307cc25cbb6a19f7ddf70c0a199be5bab0f1803a157d51ad79
SHA512e4b5ac2420c59290a40b69ed426bd175bdb01d149974edd04a9d650b790912f0097d0049cab11d21866193f5391ce2a9439cc24656a26cabfe9f55b0768568dd
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d208e9da3473eacb7c271b823e926d3f
SHA1bdd3be5fe18fd5e534ea1131c39fcafe908ae46f
SHA256489e5ef36222411026c41e399158dd1cfb45e5caad6555c9a33aa7a563c73525
SHA512267bdc6cee96bc8aef82fd0fdd50472dfebe30c812e7c3299e7aa632024af208acd8a5926f24442b4d88a1bdb2213783e52b6bbd7ff45b96d1d9ce9fb39a0faf
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD573e64ec8e743ed536c2dc8637ad08389
SHA19e1bac70dd086ec9c88f9a1daefde153d20583e6
SHA256c941841710e0b9f98b8519c8d702277060d9fb7f46899b0845819bafd9d823e4
SHA5127db372d195a32d819168afeed2d57cfbe767ef4a6a8f084c8bd90f13d25c4a393ad211837b2f394e8819e1f95b51536da3df55b68d75139fdd77860d2703afcd