Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
731.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
3Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
97s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2025, 05:14
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3674642747-2260306818-3009887879-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1960 sc.exe 4556 sc.exe 3156 sc.exe 1544 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 7008 PING.EXE 6984 cmd.exe -
Kills process with taskkill 47 IoCs
pid Process 4492 taskkill.exe 4196 taskkill.exe 4680 taskkill.exe 4368 taskkill.exe 688 taskkill.exe 3912 taskkill.exe 3208 taskkill.exe 3672 taskkill.exe 3936 taskkill.exe 2176 taskkill.exe 4028 taskkill.exe 1944 taskkill.exe 928 taskkill.exe 3500 taskkill.exe 1772 taskkill.exe 2948 taskkill.exe 5044 taskkill.exe 1524 taskkill.exe 4844 taskkill.exe 1392 taskkill.exe 5040 taskkill.exe 348 taskkill.exe 628 taskkill.exe 2348 taskkill.exe 2888 taskkill.exe 3540 taskkill.exe 536 taskkill.exe 4704 taskkill.exe 2492 taskkill.exe 3780 taskkill.exe 208 taskkill.exe 5028 taskkill.exe 4660 taskkill.exe 4740 taskkill.exe 1784 taskkill.exe 456 taskkill.exe 1692 taskkill.exe 640 taskkill.exe 2376 taskkill.exe 4716 taskkill.exe 3584 taskkill.exe 3572 taskkill.exe 4816 taskkill.exe 8 taskkill.exe 2016 taskkill.exe 1032 taskkill.exe 1168 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 6928 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 7008 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 456 taskkill.exe Token: SeDebugPrivilege 3500 taskkill.exe Token: SeDebugPrivilege 5040 taskkill.exe Token: SeDebugPrivilege 4844 taskkill.exe Token: SeDebugPrivilege 640 taskkill.exe Token: SeDebugPrivilege 3780 taskkill.exe Token: SeDebugPrivilege 1392 taskkill.exe Token: SeDebugPrivilege 1944 taskkill.exe Token: SeDebugPrivilege 928 taskkill.exe Token: SeDebugPrivilege 1168 taskkill.exe Token: SeDebugPrivilege 2376 taskkill.exe Token: SeDebugPrivilege 3936 taskkill.exe Token: SeDebugPrivilege 3208 taskkill.exe Token: SeDebugPrivilege 348 taskkill.exe Token: SeDebugPrivilege 3584 taskkill.exe Token: SeDebugPrivilege 3572 taskkill.exe Token: SeDebugPrivilege 688 taskkill.exe Token: SeDebugPrivilege 3540 taskkill.exe Token: SeDebugPrivilege 1524 taskkill.exe Token: SeDebugPrivilege 2492 taskkill.exe Token: SeDebugPrivilege 536 taskkill.exe Token: SeDebugPrivilege 208 taskkill.exe Token: SeDebugPrivilege 3912 taskkill.exe Token: SeDebugPrivilege 4816 taskkill.exe Token: SeDebugPrivilege 4704 taskkill.exe Token: SeDebugPrivilege 2176 taskkill.exe Token: SeDebugPrivilege 4716 taskkill.exe Token: SeDebugPrivilege 628 taskkill.exe Token: SeDebugPrivilege 1692 taskkill.exe Token: SeDebugPrivilege 4368 taskkill.exe Token: SeDebugPrivilege 3672 taskkill.exe Token: SeDebugPrivilege 1772 taskkill.exe Token: SeDebugPrivilege 4492 taskkill.exe Token: SeDebugPrivilege 1032 taskkill.exe Token: SeDebugPrivilege 4740 taskkill.exe Token: SeDebugPrivilege 2888 taskkill.exe Token: SeDebugPrivilege 4660 taskkill.exe Token: SeDebugPrivilege 4028 taskkill.exe Token: SeDebugPrivilege 8 taskkill.exe Token: SeDebugPrivilege 2948 taskkill.exe Token: SeDebugPrivilege 2016 taskkill.exe Token: SeDebugPrivilege 1784 taskkill.exe Token: SeDebugPrivilege 4680 taskkill.exe Token: SeDebugPrivilege 2348 taskkill.exe Token: SeDebugPrivilege 4196 taskkill.exe Token: SeDebugPrivilege 5028 taskkill.exe Token: SeDebugPrivilege 1244 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3428 wrote to memory of 4556 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 3428 wrote to memory of 4556 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 3428 wrote to memory of 1960 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 3428 wrote to memory of 1960 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 3428 wrote to memory of 1420 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 3428 wrote to memory of 1420 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 3428 wrote to memory of 1544 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 3428 wrote to memory of 1544 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 3428 wrote to memory of 3156 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 3428 wrote to memory of 3156 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 3428 wrote to memory of 348 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 3428 wrote to memory of 348 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 3428 wrote to memory of 3540 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 3428 wrote to memory of 3540 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 3428 wrote to memory of 5040 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 3428 wrote to memory of 5040 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 3428 wrote to memory of 1392 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 3428 wrote to memory of 1392 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 3428 wrote to memory of 3780 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 3428 wrote to memory of 3780 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 3428 wrote to memory of 1032 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 3428 wrote to memory of 1032 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 3428 wrote to memory of 2492 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 3428 wrote to memory of 2492 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 3428 wrote to memory of 208 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 3428 wrote to memory of 208 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 3428 wrote to memory of 1168 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 3428 wrote to memory of 1168 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 3428 wrote to memory of 4844 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 3428 wrote to memory of 4844 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 3428 wrote to memory of 640 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 3428 wrote to memory of 640 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 3428 wrote to memory of 3500 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 3428 wrote to memory of 3500 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 3428 wrote to memory of 928 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 3428 wrote to memory of 928 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 3428 wrote to memory of 2016 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 3428 wrote to memory of 2016 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 3428 wrote to memory of 8 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 3428 wrote to memory of 8 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 3428 wrote to memory of 4816 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 3428 wrote to memory of 4816 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 3428 wrote to memory of 1944 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 3428 wrote to memory of 1944 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 3428 wrote to memory of 3572 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 3428 wrote to memory of 3572 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 3428 wrote to memory of 4028 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 3428 wrote to memory of 4028 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 3428 wrote to memory of 1524 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 3428 wrote to memory of 1524 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 3428 wrote to memory of 5044 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 3428 wrote to memory of 5044 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 3428 wrote to memory of 3208 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 3428 wrote to memory of 3208 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 3428 wrote to memory of 1692 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 3428 wrote to memory of 1692 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 3428 wrote to memory of 3912 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 3428 wrote to memory of 3912 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 3428 wrote to memory of 4704 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 3428 wrote to memory of 4704 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 3428 wrote to memory of 2176 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 3428 wrote to memory of 2176 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 3428 wrote to memory of 456 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 3428 wrote to memory of 456 3428 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:4556
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:1960
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:1420
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:1544
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:3156
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:348
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3540
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2492
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:928
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:8
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3572
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:5044
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3208
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4704
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:456
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3936
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:536
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:688
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3584
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1244
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:6928
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:6984 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:7008
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:6448
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:7084
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:7144
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5db61af070e4638193491916ed6d5ac56
SHA136e8ec2c04efbf0d03fe13deb24b17596e77cabc
SHA25630380f5304bba9429e61402389b22134587f695dec36d8169fdea88ee41750b8
SHA512ccd9f0ed76196638467e2f5083c279cbc50367fdacfd7aca2497581db4e51a6201fa6204ebd8c3cfe88f8c000584d7d66c97d116d43a8be0534d2ecac8ab51ea
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD59be582ab8d0d8623fb1dd81a5c21bd2f
SHA1dcaa9be72c7a33d780f69201e3b6495b1b304ef8
SHA2560c470d16f7b7754b9d81e4b9831ffe685c4169790134c9709f2d0e943866d4e8
SHA5121fa57a1df4f5b975fc3841f00af5f369bce47660e0a9d2743767cf332259620c01c76c11d62ae21c94040f3a5f231a7a97e3d102d3e0886354a9d208da0e9aa4
-
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Filesize804KB
MD573a0e31e1c598ea1c51353edd63d8457
SHA1fcbabca0997f891ec546ae882ced4dfc987d7fc5
SHA256125550886fe7183856f44a6fcec67db3a05172f064574bd3d9dd08232d0a1bb0
SHA512a5f4d492e891881cc5cf548886ffe8b98787c5d739f8a9002a2686c316d8d36576f425ce96595b122c2357ffca6f6ba76568af2a2ffc3589b415f10de38ccdf2
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD583176794bf7e2fdad18b3821cbf86ce6
SHA13d56f3eb998710d71d5eb27180172dd348cc7b27
SHA25604ddc544a965009047ba037e27528f6540995830955e683792565603129ff0e8
SHA5121e24df2d2ec26b82644ce994c2ca4621206ca1e75ff3f7a7b435ce9e783d6be5c18a8d8d66dae30d6758542d348c1fba0949e44dc79208a0b9a1138bffe7d601
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD54814896f201a75954063d02d8b3f0365
SHA1b2a6aaa6f32882d6e530a711cafbbf2f461e98fd
SHA25617ee5f3e79fee5884ecc405a038b6bbe80b65ea640589cd7468ffcd824bc8ca7
SHA5123fffe1046b3233b90e9260087fcf0fa3ed497554c975172a1b68c9acd87035d83a123a66b567ff46f5e5ffd306dcd83ca7335c4a47b087ef04a80c4a3ebe0768
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD57ebbb17f3791dea62cf267d83cf036a4
SHA1266c27acf64b85afd8380277f767cc54f91ab2b0
SHA2562345628c466a33c557a0fba468c06436ce7121c56e6260492c5d6ce52d05ba19
SHA5126e519f44c8d4e9fe752471f19ec9956e3cd6d73f741496d09bb0fb0c8f0048636b6a52204fa475436c0403d022500fd33452e0ad8f18b3ed2245b24b5bd7bb51
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD5ddb6dd30f5f884d51a9f2c3fecdc7939
SHA12561055d5bf637ad230b5a30642243bc36d8e297
SHA256328056675c19fa275c4e942a111177e28396c79c0dc9a2481e0faf816c1f3468
SHA5121bb2ef5b8a2fab96f9114b4c1d9dde9ddac0fc6967556e5bf664ed478b8204069d06b2966b79a4f7fdb81802c1f2c205bde03ff834f67c1cb6f82fe1daba23c5