Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
3Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
109s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2025, 04:56
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 180 sc.exe 4840 sc.exe 1696 sc.exe 1844 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 6980 cmd.exe 7096 PING.EXE -
Kills process with taskkill 47 IoCs
pid Process 856 taskkill.exe 4552 taskkill.exe 1564 taskkill.exe 2244 taskkill.exe 3376 taskkill.exe 3820 taskkill.exe 3364 taskkill.exe 2980 taskkill.exe 4600 taskkill.exe 4884 taskkill.exe 2808 taskkill.exe 5072 taskkill.exe 2976 taskkill.exe 1596 taskkill.exe 396 taskkill.exe 2648 taskkill.exe 3940 taskkill.exe 2704 taskkill.exe 2676 taskkill.exe 3228 taskkill.exe 2260 taskkill.exe 908 taskkill.exe 1748 taskkill.exe 1804 taskkill.exe 3628 taskkill.exe 4528 taskkill.exe 3732 taskkill.exe 1380 taskkill.exe 3956 taskkill.exe 3324 taskkill.exe 1992 taskkill.exe 2280 taskkill.exe 3260 taskkill.exe 1328 taskkill.exe 1488 taskkill.exe 4752 taskkill.exe 2104 taskkill.exe 4832 taskkill.exe 1136 taskkill.exe 3300 taskkill.exe 2708 taskkill.exe 3520 taskkill.exe 2224 taskkill.exe 1440 taskkill.exe 2628 taskkill.exe 3396 taskkill.exe 3384 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 6988 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 7096 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 3628 taskkill.exe Token: SeDebugPrivilege 1136 taskkill.exe Token: SeDebugPrivilege 2260 taskkill.exe Token: SeDebugPrivilege 1380 taskkill.exe Token: SeDebugPrivilege 4752 taskkill.exe Token: SeDebugPrivilege 4528 taskkill.exe Token: SeDebugPrivilege 2628 taskkill.exe Token: SeDebugPrivilege 856 taskkill.exe Token: SeDebugPrivilege 5072 taskkill.exe Token: SeDebugPrivilege 3364 taskkill.exe Token: SeDebugPrivilege 3956 taskkill.exe Token: SeDebugPrivilege 2976 taskkill.exe Token: SeDebugPrivilege 2808 taskkill.exe Token: SeDebugPrivilege 3260 taskkill.exe Token: SeDebugPrivilege 2244 taskkill.exe Token: SeDebugPrivilege 1992 taskkill.exe Token: SeDebugPrivilege 1804 taskkill.exe Token: SeDebugPrivilege 2676 taskkill.exe Token: SeDebugPrivilege 3300 taskkill.exe Token: SeDebugPrivilege 2704 taskkill.exe Token: SeDebugPrivilege 3520 taskkill.exe Token: SeDebugPrivilege 1328 taskkill.exe Token: SeDebugPrivilege 4600 taskkill.exe Token: SeDebugPrivilege 1596 taskkill.exe Token: SeDebugPrivilege 3396 taskkill.exe Token: SeDebugPrivilege 2224 taskkill.exe Token: SeDebugPrivilege 2104 taskkill.exe Token: SeDebugPrivilege 2708 taskkill.exe Token: SeDebugPrivilege 3820 taskkill.exe Token: SeDebugPrivilege 3732 taskkill.exe Token: SeDebugPrivilege 2980 taskkill.exe Token: SeDebugPrivilege 3940 taskkill.exe Token: SeDebugPrivilege 908 taskkill.exe Token: SeDebugPrivilege 3452 powershell.exe Token: SeDebugPrivilege 4552 taskkill.exe Token: SeDebugPrivilege 4884 taskkill.exe Token: SeDebugPrivilege 2648 taskkill.exe Token: SeDebugPrivilege 396 taskkill.exe Token: SeDebugPrivilege 3228 taskkill.exe Token: SeDebugPrivilege 1748 taskkill.exe Token: SeDebugPrivilege 2280 taskkill.exe Token: SeDebugPrivilege 1440 taskkill.exe Token: SeDebugPrivilege 1564 taskkill.exe Token: SeDebugPrivilege 1488 taskkill.exe Token: SeDebugPrivilege 3324 taskkill.exe Token: SeDebugPrivilege 4832 taskkill.exe Token: SeDebugPrivilege 3376 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3512 wrote to memory of 180 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 3512 wrote to memory of 180 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 3512 wrote to memory of 1844 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 3512 wrote to memory of 1844 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 3512 wrote to memory of 1696 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 3512 wrote to memory of 1696 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 3512 wrote to memory of 4840 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 3512 wrote to memory of 4840 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 3512 wrote to memory of 1992 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 3512 wrote to memory of 1992 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 3512 wrote to memory of 4416 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 3512 wrote to memory of 4416 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 3512 wrote to memory of 3628 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 3512 wrote to memory of 3628 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 3512 wrote to memory of 3520 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 3512 wrote to memory of 3520 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 3512 wrote to memory of 2808 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 3512 wrote to memory of 2808 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 3512 wrote to memory of 1804 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 3512 wrote to memory of 1804 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 3512 wrote to memory of 1328 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 3512 wrote to memory of 1328 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 3512 wrote to memory of 2676 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 3512 wrote to memory of 2676 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 3512 wrote to memory of 2704 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 3512 wrote to memory of 2704 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 3512 wrote to memory of 1748 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 3512 wrote to memory of 1748 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 3512 wrote to memory of 4884 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 3512 wrote to memory of 4884 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 3512 wrote to memory of 3940 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 3512 wrote to memory of 3940 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 3512 wrote to memory of 2708 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 3512 wrote to memory of 2708 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 3512 wrote to memory of 2648 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 3512 wrote to memory of 2648 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 3512 wrote to memory of 3300 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 3512 wrote to memory of 3300 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 3512 wrote to memory of 396 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 3512 wrote to memory of 396 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 3512 wrote to memory of 4600 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 3512 wrote to memory of 4600 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 3512 wrote to memory of 1136 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 3512 wrote to memory of 1136 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 3512 wrote to memory of 908 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 3512 wrote to memory of 908 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 3512 wrote to memory of 4832 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 3512 wrote to memory of 4832 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 3512 wrote to memory of 3376 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 3512 wrote to memory of 3376 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 3512 wrote to memory of 3384 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 3512 wrote to memory of 3384 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 3512 wrote to memory of 3324 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 3512 wrote to memory of 3324 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 3512 wrote to memory of 2104 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 3512 wrote to memory of 2104 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 3512 wrote to memory of 2260 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 3512 wrote to memory of 2260 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 3512 wrote to memory of 3396 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 3512 wrote to memory of 3396 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 3512 wrote to memory of 856 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 3512 wrote to memory of 856 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 3512 wrote to memory of 2980 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 130 PID 3512 wrote to memory of 2980 3512 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:180
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:1844
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:1696
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:4840
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:4416
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3520
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1328
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:908
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:3384
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3396
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:856
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3956
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3260
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4752
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4552
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4528
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:6988
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:6980 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:7096
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:6372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:7032
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:7140
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5682c48cfb4402af4be61106ca3adcfdc
SHA1ca4ba80da9fdc53e4413efdf2d4dd80af9d146b7
SHA256052120d0afa8fc000f7c202021bb584be5bbcb82b0adeafa7df550b222784568
SHA512f3b473a30703efbaf95df3d7d2fe5be32651a360726058ac3f51d46aef6e544b95f418d0a7c7801d2462f7af2c3be38b6b4085cce9e395205e7f1a4b6e308323
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD556bc091917a1781910e5b1f0afc9f908
SHA172e4c444249989102a31280d0966c35eb5ddf32e
SHA25629c9b530f5d938f0cd78d2377b2c9aee932ee501e1c540100bb51cd1c4c32a11
SHA5123f4b22a59df52137f7569b4ec016a4bf37d48cf059910cff109cb0793e36927e1feb06733e0352020f5ad7b7f849b09a951e3deec0349642877ddcc5d4c4eb73
-
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Filesize804KB
MD5ed505a36233a1d6b73204940fa7960c8
SHA174c32fb1afe7ff1466372ee468643ad9993a9693
SHA256456f1eae9c3f83fc73fb4916c7da43d1e6329282d56494e37052bf30f55620f1
SHA51280d959324d50b4a6e7048fce40ed070b86c8ad79c2b4a6a54bf8b6e6423e1b8a5f5cd81be636d72f8ac90c488a8c682a63c7bbc77397f50f167a6b056287c7b8
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD53b34cc170e5e7de3c71b36830dceeffd
SHA15f3c90f31a4ca145993adefc3278de871659f3df
SHA2569d960b0e138b775f359a06b8510d231fdf6d5b49d39585b6bc3726e61d465050
SHA512b2201a5c2f797db31bb24b002f6682200c44a757b18495daf12437cfff1eff50966e7e830f60a664cbba4d3eb46dd0cdb1c508ff85998b1d4f86df46154bc338
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD53e864891030aff8166ac92ff3865286a
SHA1685473fb56856188f6c36e9d02cc8ecc94c75cb2
SHA25630ae31b4e950a60dbea38834b2cbf51af43936bf997fd4aa01c4c9b72dd2e982
SHA5126a1d5b31592f5e612a1bee34b1f28b4e78c58585d4a9a112849c57b889008260f415a30ebf09c10447724a97c462f562bbbc6b529716d4f40ec3cacd88763d6f
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD594256212310a547ba240e2aa86468177
SHA1f52a751219868220e86405aba60f0504332444be
SHA2564ff13717087ef748699f1fd75630e1ff8d92694f4d2079826c7229608639c50a
SHA51222efada6acfff168e1d60d5fbd9ae9b504a7eb52ae30e4a5b571880e9c8a4ff4dff7fbf453d5c7281e13b5d7ab9b4269f040dc1d58e523edf6de9496b4a0dd79
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD5b58927e1b2d7e25066bf7d8e8a97a551
SHA197d0726f3fbed42e603aa2dae9ea7dee7f1c471d
SHA2566f87c53e1e8a28b35b1f822340efa46cf5df0739a28128d4d4abd81e1964af43
SHA51221cff7dba1ae6f7a767c7673531fcaccbbd8e42a253ddc54fb802c705eae626bb705d0f213a9764f4fcdbbd621363c0e81159c32997fb8fcf5b0a7aac9f1ebaf