Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
731.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
97s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2025, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3116 sc.exe 3004 sc.exe 2996 sc.exe 2116 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 7088 cmd.exe 1064 PING.EXE -
Kills process with taskkill 47 IoCs
pid Process 3264 taskkill.exe 688 taskkill.exe 2168 taskkill.exe 5972 taskkill.exe 4688 taskkill.exe 4892 taskkill.exe 4960 taskkill.exe 2816 taskkill.exe 4684 taskkill.exe 1112 taskkill.exe 4904 taskkill.exe 4728 taskkill.exe 2100 taskkill.exe 2080 taskkill.exe 5956 taskkill.exe 4160 taskkill.exe 4856 taskkill.exe 4656 taskkill.exe 4464 taskkill.exe 5724 taskkill.exe 5296 taskkill.exe 3256 taskkill.exe 1248 taskkill.exe 5320 taskkill.exe 1104 taskkill.exe 2024 taskkill.exe 4560 taskkill.exe 4876 taskkill.exe 4612 taskkill.exe 5384 taskkill.exe 6116 taskkill.exe 5836 taskkill.exe 3592 taskkill.exe 4972 taskkill.exe 4716 taskkill.exe 4300 taskkill.exe 4492 taskkill.exe 5924 taskkill.exe 5196 taskkill.exe 1296 taskkill.exe 4752 taskkill.exe 2044 taskkill.exe 2892 taskkill.exe 1140 taskkill.exe 5316 taskkill.exe 4304 taskkill.exe 4720 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 7080 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1064 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 4684 taskkill.exe Token: SeDebugPrivilege 1104 taskkill.exe Token: SeDebugPrivilege 5972 taskkill.exe Token: SeDebugPrivilege 1296 taskkill.exe Token: SeDebugPrivilege 5296 taskkill.exe Token: SeDebugPrivilege 5196 taskkill.exe Token: SeDebugPrivilege 4972 taskkill.exe Token: SeDebugPrivilege 1112 taskkill.exe Token: SeDebugPrivilege 4560 taskkill.exe Token: SeDebugPrivilege 3256 taskkill.exe Token: SeDebugPrivilege 1140 taskkill.exe Token: SeDebugPrivilege 4688 taskkill.exe Token: SeDebugPrivilege 4752 taskkill.exe Token: SeDebugPrivilege 4300 taskkill.exe Token: SeDebugPrivilege 2892 taskkill.exe Token: SeDebugPrivilege 2044 taskkill.exe Token: SeDebugPrivilege 5724 taskkill.exe Token: SeDebugPrivilege 4720 taskkill.exe Token: SeDebugPrivilege 4492 taskkill.exe Token: SeDebugPrivilege 4716 taskkill.exe Token: SeDebugPrivilege 4612 taskkill.exe Token: SeDebugPrivilege 2100 taskkill.exe Token: SeDebugPrivilege 4856 taskkill.exe Token: SeDebugPrivilege 3264 taskkill.exe Token: SeDebugPrivilege 5384 taskkill.exe Token: SeDebugPrivilege 1248 taskkill.exe Token: SeDebugPrivilege 4728 taskkill.exe Token: SeDebugPrivilege 2168 taskkill.exe Token: SeDebugPrivilege 4656 taskkill.exe Token: SeDebugPrivilege 4464 taskkill.exe Token: SeDebugPrivilege 2816 taskkill.exe Token: SeDebugPrivilege 4892 taskkill.exe Token: SeDebugPrivilege 5924 taskkill.exe Token: SeDebugPrivilege 2024 taskkill.exe Token: SeDebugPrivilege 4904 taskkill.exe Token: SeDebugPrivilege 5320 taskkill.exe Token: SeDebugPrivilege 3592 taskkill.exe Token: SeDebugPrivilege 688 taskkill.exe Token: SeDebugPrivilege 5316 taskkill.exe Token: SeDebugPrivilege 4960 taskkill.exe Token: SeDebugPrivilege 4160 taskkill.exe Token: SeDebugPrivilege 4304 taskkill.exe Token: SeDebugPrivilege 4876 taskkill.exe Token: SeDebugPrivilege 5956 taskkill.exe Token: SeDebugPrivilege 6116 taskkill.exe Token: SeDebugPrivilege 5836 taskkill.exe Token: SeDebugPrivilege 6024 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5868 wrote to memory of 3116 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 5868 wrote to memory of 3116 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 5868 wrote to memory of 2116 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 5868 wrote to memory of 2116 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 5868 wrote to memory of 2996 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 5868 wrote to memory of 2996 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 5868 wrote to memory of 3004 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 5868 wrote to memory of 3004 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 5868 wrote to memory of 1104 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 5868 wrote to memory of 1104 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 5868 wrote to memory of 1296 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 5868 wrote to memory of 1296 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 5868 wrote to memory of 5296 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 5868 wrote to memory of 5296 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 5868 wrote to memory of 5724 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 5868 wrote to memory of 5724 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 5868 wrote to memory of 5972 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 5868 wrote to memory of 5972 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 5868 wrote to memory of 1112 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 5868 wrote to memory of 1112 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 5868 wrote to memory of 4972 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 5868 wrote to memory of 4972 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 5868 wrote to memory of 5196 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 5868 wrote to memory of 5196 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 5868 wrote to memory of 4684 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 5868 wrote to memory of 4684 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 5868 wrote to memory of 5656 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 5868 wrote to memory of 5656 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 5868 wrote to memory of 4560 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 5868 wrote to memory of 4560 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 5868 wrote to memory of 4716 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 5868 wrote to memory of 4716 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 5868 wrote to memory of 4720 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 5868 wrote to memory of 4720 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 5868 wrote to memory of 4752 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 5868 wrote to memory of 4752 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 5868 wrote to memory of 4876 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 5868 wrote to memory of 4876 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 5868 wrote to memory of 4612 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 5868 wrote to memory of 4612 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 5868 wrote to memory of 2044 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 5868 wrote to memory of 2044 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 5868 wrote to memory of 3256 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 5868 wrote to memory of 3256 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 5868 wrote to memory of 3264 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 5868 wrote to memory of 3264 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 5868 wrote to memory of 1140 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 5868 wrote to memory of 1140 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 5868 wrote to memory of 4492 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 123 PID 5868 wrote to memory of 4492 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 123 PID 5868 wrote to memory of 2080 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 124 PID 5868 wrote to memory of 2080 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 124 PID 5868 wrote to memory of 2892 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 125 PID 5868 wrote to memory of 2892 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 125 PID 5868 wrote to memory of 5384 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 127 PID 5868 wrote to memory of 5384 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 127 PID 5868 wrote to memory of 2100 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 5868 wrote to memory of 2100 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 5868 wrote to memory of 4300 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 130 PID 5868 wrote to memory of 4300 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 130 PID 5868 wrote to memory of 2168 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 132 PID 5868 wrote to memory of 2168 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 132 PID 5868 wrote to memory of 4464 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 133 PID 5868 wrote to memory of 4464 5868 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 133
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:3116
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:2116
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:2996
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:3004
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5296
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5724
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5972
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5196
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:5656
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4752
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4876
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4612
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3256
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:2080
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5384
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4656
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4904
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:688
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3592
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5320
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5956
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6116
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5316
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5924
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5836
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4160
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:6024
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:7080
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:7088 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1064
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:5616
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:7052
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:6456
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD58b0e6b329e10690fdd2a8fa8c00c1c19
SHA1a4b8358d0fe39f9116cf7866c884270b9fa67b4d
SHA2566e6e9634339fa105a427ef5a4754e019484213fcab61e748fac228b1cad1675a
SHA51263c5fa09cfc3897061257e8adc76f7fe1116bfc769c52c788fa72456c910f327cf94c3b3f4feb35bbaeb988ca463ab8888976678c8a19b8de213cbc30db3916d
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD53080ea35e852d4931c5bd623c36c1579
SHA1f427f25a79303745826418d9f286f8651101c244
SHA2564f8fcfc89a2eacdbc42ba3f6e0661f81ebcf285145f02336c63423ebed490cc1
SHA512a2b73cfbab67ca5e6f5633306a1cbc4808552e2a83adc81fa474b61f961b0feeb11d2cca79e46961b11ccbc241352b4e6a03863f0f599b1d5fd873910637a11a
-
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Filesize804KB
MD5dbec20383217be97a135e6c2688638f0
SHA194b9d716dd1d1e3c71296c3aeae74fa349a5c661
SHA256ee216245d85807a0bca25c65c8ebec3d755bec741c569d1522ceb30d26049dd7
SHA51295a877c518c28e80a19841a4204b1d2390635a02ddff93ed010bb7b0eec46f5739041dddd776afadfcd54321b444ad90f24ac6a02c8be94a4bfe9e0e003ba557
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD5e1e8698145f7c1ae7f1c5ebe079b13ef
SHA1c8abbf16311bacda66b028a039eacbc2020a229e
SHA256c87f671ee6180d683d1c87bfd33b013d959ce9313c03a75779b5ca20001c1387
SHA512b058ce20de6bddd5a3544e2db5c27d623ebfec4750d1d10e892179ba32af52134b9bd2af5ce6ecffb3d463fe6acd27864c02837a3684ff2282fa099a487cf962
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD52655405a33e066dde607c60e36b4c8b9
SHA1f7bc0862eaafdda06b33c45de8a543e26e22262b
SHA256fbe5bae770bce80c9699b918a347b3a3683eeb7ca3fa38ec337f3fd08965aaea
SHA5123a382c8d7b3f2aab1e7452137e32762040794e052460148d48415bef051873a74b011b3f8b02b629b6b6fa5b60a40d2234eb33beb5f7548eb37ca98981ee946e
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD547d9df7fab0d0c96afdd2ca49f2b5030
SHA192583883bcf376062ddef5db2333f066d8d36612
SHA2560f244dd39698dace2c650435886b1175ea01131e581d6c13888576c07fa40b02
SHA5121844ce4f35849b70c246127482040986caa1bbae2d81119c77e9841f2a3280aabae0ad0db52fc29fe48023b4f4c073fe759b1f54e70e1562289d5e349c015200
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD59b7f72f2f2a46d5b39f97ce8b62a53e1
SHA11526bebef5ee0ec24493f2c2d640f766d4c2ce08
SHA2565a615c1135edcdaa50b5ffe954c41aa97536ff3c12768d556a19b9fe2f981843
SHA51288e697c1f90ab057d42dd9d27db33927e3fe1bbd8ee250917b755f88e0a32ed1b0cb573af089488fda3c791cae9eef5e6cd01372e309f61509b48b53abe164e5