Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
7c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
96s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2025, 05:00
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3299287909-2279959458-198972791-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4524 sc.exe 4568 sc.exe 4700 sc.exe 4612 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3960 cmd.exe 7052 PING.EXE -
Kills process with taskkill 47 IoCs
pid Process 4592 taskkill.exe 960 taskkill.exe 1088 taskkill.exe 4848 taskkill.exe 4736 taskkill.exe 4108 taskkill.exe 388 taskkill.exe 5504 taskkill.exe 5540 taskkill.exe 3264 taskkill.exe 5292 taskkill.exe 3344 taskkill.exe 1524 taskkill.exe 2000 taskkill.exe 5532 taskkill.exe 1092 taskkill.exe 2328 taskkill.exe 5204 taskkill.exe 632 taskkill.exe 4728 taskkill.exe 748 taskkill.exe 2120 taskkill.exe 1264 taskkill.exe 3020 taskkill.exe 4856 taskkill.exe 4792 taskkill.exe 4272 taskkill.exe 4748 taskkill.exe 1504 taskkill.exe 6088 taskkill.exe 3084 taskkill.exe 4924 taskkill.exe 1620 taskkill.exe 6012 taskkill.exe 4576 taskkill.exe 4588 taskkill.exe 4068 taskkill.exe 3700 taskkill.exe 1000 taskkill.exe 856 taskkill.exe 4720 taskkill.exe 4316 taskkill.exe 316 taskkill.exe 3168 taskkill.exe 2456 taskkill.exe 5652 taskkill.exe 4384 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 6940 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 7052 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 4272 taskkill.exe Token: SeDebugPrivilege 856 taskkill.exe Token: SeDebugPrivilege 1620 taskkill.exe Token: SeDebugPrivilege 4588 taskkill.exe Token: SeDebugPrivilege 4720 taskkill.exe Token: SeDebugPrivilege 4736 taskkill.exe Token: SeDebugPrivilege 632 taskkill.exe Token: SeDebugPrivilege 4592 taskkill.exe Token: SeDebugPrivilege 4792 taskkill.exe Token: SeDebugPrivilege 4728 taskkill.exe Token: SeDebugPrivilege 2456 taskkill.exe Token: SeDebugPrivilege 4576 taskkill.exe Token: SeDebugPrivilege 3344 taskkill.exe Token: SeDebugPrivilege 6012 taskkill.exe Token: SeDebugPrivilege 4848 taskkill.exe Token: SeDebugPrivilege 5204 taskkill.exe Token: SeDebugPrivilege 316 taskkill.exe Token: SeDebugPrivilege 2328 taskkill.exe Token: SeDebugPrivilege 4384 taskkill.exe Token: SeDebugPrivilege 1000 taskkill.exe Token: SeDebugPrivilege 4316 taskkill.exe Token: SeDebugPrivilege 3020 taskkill.exe Token: SeDebugPrivilege 1504 taskkill.exe Token: SeDebugPrivilege 1088 taskkill.exe Token: SeDebugPrivilege 3264 taskkill.exe Token: SeDebugPrivilege 5504 taskkill.exe Token: SeDebugPrivilege 2000 taskkill.exe Token: SeDebugPrivilege 4748 taskkill.exe Token: SeDebugPrivilege 3084 taskkill.exe Token: SeDebugPrivilege 4924 taskkill.exe Token: SeDebugPrivilege 3168 taskkill.exe Token: SeDebugPrivilege 2120 taskkill.exe Token: SeDebugPrivilege 4856 taskkill.exe Token: SeDebugPrivilege 1264 taskkill.exe Token: SeDebugPrivilege 388 taskkill.exe Token: SeDebugPrivilege 960 taskkill.exe Token: SeDebugPrivilege 4068 taskkill.exe Token: SeDebugPrivilege 3700 taskkill.exe Token: SeDebugPrivilege 748 taskkill.exe Token: SeDebugPrivilege 6088 taskkill.exe Token: SeDebugPrivilege 5532 taskkill.exe Token: SeDebugPrivilege 4108 taskkill.exe Token: SeDebugPrivilege 5540 taskkill.exe Token: SeDebugPrivilege 5652 taskkill.exe Token: SeDebugPrivilege 1524 taskkill.exe Token: SeDebugPrivilege 2264 powershell.exe Token: SeDebugPrivilege 1092 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4504 wrote to memory of 4524 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 4504 wrote to memory of 4524 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 4504 wrote to memory of 4568 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 4504 wrote to memory of 4568 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 4504 wrote to memory of 4612 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 4504 wrote to memory of 4612 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 4504 wrote to memory of 4700 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 4504 wrote to memory of 4700 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 4504 wrote to memory of 4720 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 4504 wrote to memory of 4720 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 4504 wrote to memory of 4728 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 4504 wrote to memory of 4728 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 4504 wrote to memory of 4592 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 4504 wrote to memory of 4592 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 4504 wrote to memory of 4736 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 4504 wrote to memory of 4736 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 4504 wrote to memory of 4748 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 4504 wrote to memory of 4748 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 4504 wrote to memory of 4588 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 4504 wrote to memory of 4588 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 4504 wrote to memory of 4576 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 4504 wrote to memory of 4576 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 4504 wrote to memory of 548 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 4504 wrote to memory of 548 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 4504 wrote to memory of 4272 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 4504 wrote to memory of 4272 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 4504 wrote to memory of 2456 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 4504 wrote to memory of 2456 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 4504 wrote to memory of 632 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 4504 wrote to memory of 632 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 4504 wrote to memory of 6012 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 4504 wrote to memory of 6012 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 4504 wrote to memory of 856 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 4504 wrote to memory of 856 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 4504 wrote to memory of 1620 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 4504 wrote to memory of 1620 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 4504 wrote to memory of 4384 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 4504 wrote to memory of 4384 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 4504 wrote to memory of 5204 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 4504 wrote to memory of 5204 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 4504 wrote to memory of 4792 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 4504 wrote to memory of 4792 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 4504 wrote to memory of 4856 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 4504 wrote to memory of 4856 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 4504 wrote to memory of 4848 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 4504 wrote to memory of 4848 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 4504 wrote to memory of 4924 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 128 PID 4504 wrote to memory of 4924 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 128 PID 4504 wrote to memory of 1000 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 4504 wrote to memory of 1000 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 4504 wrote to memory of 5292 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 130 PID 4504 wrote to memory of 5292 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 130 PID 4504 wrote to memory of 2120 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 131 PID 4504 wrote to memory of 2120 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 131 PID 4504 wrote to memory of 748 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 132 PID 4504 wrote to memory of 748 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 132 PID 4504 wrote to memory of 3264 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 138 PID 4504 wrote to memory of 3264 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 138 PID 4504 wrote to memory of 5540 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 139 PID 4504 wrote to memory of 5540 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 139 PID 4504 wrote to memory of 5504 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 140 PID 4504 wrote to memory of 5504 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 140 PID 4504 wrote to memory of 3084 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 141 PID 4504 wrote to memory of 3084 4504 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:4524
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:4568
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:4612
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:4700
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4748
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:548
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:632
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6012
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:856
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5204
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:5292
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:748
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5540
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5504
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3084
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3168
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6088
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5532
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5652
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1088
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:316
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:388
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4068
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:960
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3344
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:6940
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3960 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:7052
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:6156
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:6908
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:7076
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD50e0a8877e3f7197f87d67e568ff241a5
SHA14241e41b4b8d42831f2a0f4f5283d2df9eb199fd
SHA256d18769af69dc603eeee3ef58b42502e2a501430f4d30ae574c72a29125d28239
SHA512eb50bf274795d36c6c2e5ce024e0173a8b0ce1769796b742ce1076274c2fdcebb7562d4e3b356035c1596357db1ca05ddb57e9f251063fc4df47a58036582c19
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD5f86be53b21e430512f147fa1af02edec
SHA1ac5ae2f04699cab27c899e4d2cf34a5270d13755
SHA2564da8a866348d077f43bdbf179695c0b70121e55044b195972e699b178907a99c
SHA512b33eb3f811f11ceb90155a0043efd6172e8e4ea17cd3638893bcd1141c68981e2aa8ea3085136b59420402cff5729474ecb64e24c62b2706604b52d3508cda4c
-
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Filesize804KB
MD5390e1514447fa8d7b4e7f6360a12a183
SHA172958d285012aca789b412387718c916ce7bf301
SHA25661aae77225ae6c1267d53bf97d6c1b1600c3fe16154be4a95e03b96fcad7fb4b
SHA51217c9301054fec840b27749176bb1ae9a73d93fd95830d03209678b54081fb4e74af49dbc6f7a7e49307942279c55689c03d4aa70cb0f2e7722bd2a57e0c04936
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD59579fac57f273fd0a88ae17a6f710d64
SHA184ef3280534ef7b5d4a17f87f8763cad1e653ac1
SHA256225ec09f22b8dd0601e7f8bc06b541109cd3635f1c244f9964c4417dd22da4aa
SHA512bc466b440cab9b4f57c01f28637247682b12bc8ded3ce1e96b4df747cb722c86b0c7eabf48fc4916d849cf8882ed44ab8fa98a9a6c819f2b07b66079c5a6ee6b
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD58cc831b574c2bcfdc37262a5866c0998
SHA1bfd7d96b326cc950e512c2faffd123cfd94f0797
SHA256f3761e0f1a29411205e2ac59974c462d00d0e0bf8dc38498a8dad04e5f89942d
SHA512d35764c9c8518b6b1afc33d9e204245b37f7ebbd933ecef28a3fa41b1ab826c73c6dba4fb08c85e4259a6c3ab52ea4174f4ed2deaa3b8aec04b31f6789f8c287
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5737aca23f199ce589dd1e68bc4969b98
SHA18c9cdd6bdf94c5fa42c5b0c29abf0136e4e6fa00
SHA2566aa59e171898b3dd42a36662ef81d349ce5063a705f1261e881269c59e7c742b
SHA512ccc0e6fa798aeb92e6e1a14d6ef3dc23e8e829d5ffd10f11129d0e590820711e29997a761dca77b8e790b06e3c7c0d2059137f40f92543eb8048529b1b4d7817
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD5d26ce4cdda4f656846ca5bfa1e41aa54
SHA14d46761d85d616f9192740dc48fe7644d66e5042
SHA256a532ed0f721bfbd8b7b9336fd814aac128cfaac1f4ec181499cb8e289176962f
SHA5126057b514540035a9dfb510bb5d47a22055015679b30822601879ac58695ef526df760200201e86e59d437f03f8df90c29f75cc117829746b2a015d99060b9eff