Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
104s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2025, 06:00
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2620 sc.exe 544 sc.exe 4960 sc.exe 5596 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3424 cmd.exe 4388 PING.EXE -
Kills process with taskkill 47 IoCs
pid Process 4508 taskkill.exe 4544 taskkill.exe 3996 taskkill.exe 1868 taskkill.exe 2640 taskkill.exe 2880 taskkill.exe 2896 taskkill.exe 5800 taskkill.exe 3744 taskkill.exe 4552 taskkill.exe 5432 taskkill.exe 1452 taskkill.exe 916 taskkill.exe 1684 taskkill.exe 4440 taskkill.exe 2056 taskkill.exe 944 taskkill.exe 2228 taskkill.exe 4608 taskkill.exe 5024 taskkill.exe 5096 taskkill.exe 4660 taskkill.exe 1532 taskkill.exe 3448 taskkill.exe 5248 taskkill.exe 5160 taskkill.exe 3152 taskkill.exe 5412 taskkill.exe 5980 taskkill.exe 5028 taskkill.exe 4652 taskkill.exe 4560 taskkill.exe 4376 taskkill.exe 2864 taskkill.exe 4720 taskkill.exe 6080 taskkill.exe 6076 taskkill.exe 3892 taskkill.exe 4364 taskkill.exe 1104 taskkill.exe 4728 taskkill.exe 4992 taskkill.exe 4944 taskkill.exe 1500 taskkill.exe 2732 taskkill.exe 5048 taskkill.exe 4596 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4764 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4388 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 4596 taskkill.exe Token: SeDebugPrivilege 1452 taskkill.exe Token: SeDebugPrivilege 2896 taskkill.exe Token: SeDebugPrivilege 4552 taskkill.exe Token: SeDebugPrivilege 6076 taskkill.exe Token: SeDebugPrivilege 4652 taskkill.exe Token: SeDebugPrivilege 4364 taskkill.exe Token: SeDebugPrivilege 4560 taskkill.exe Token: SeDebugPrivilege 4544 taskkill.exe Token: SeDebugPrivilege 2056 taskkill.exe Token: SeDebugPrivilege 1868 taskkill.exe Token: SeDebugPrivilege 4508 taskkill.exe Token: SeDebugPrivilege 4728 taskkill.exe Token: SeDebugPrivilege 5096 taskkill.exe Token: SeDebugPrivilege 4440 taskkill.exe Token: SeDebugPrivilege 3448 taskkill.exe Token: SeDebugPrivilege 944 taskkill.exe Token: SeDebugPrivilege 3892 taskkill.exe Token: SeDebugPrivilege 4944 taskkill.exe Token: SeDebugPrivilege 5024 taskkill.exe Token: SeDebugPrivilege 1500 taskkill.exe Token: SeDebugPrivilege 5412 taskkill.exe Token: SeDebugPrivilege 4660 taskkill.exe Token: SeDebugPrivilege 4720 taskkill.exe Token: SeDebugPrivilege 6080 taskkill.exe Token: SeDebugPrivilege 5048 taskkill.exe Token: SeDebugPrivilege 5800 taskkill.exe Token: SeDebugPrivilege 5980 taskkill.exe Token: SeDebugPrivilege 2732 taskkill.exe Token: SeDebugPrivilege 5432 taskkill.exe Token: SeDebugPrivilege 5028 taskkill.exe Token: SeDebugPrivilege 4992 taskkill.exe Token: SeDebugPrivilege 5248 taskkill.exe Token: SeDebugPrivilege 5160 taskkill.exe Token: SeDebugPrivilege 2640 taskkill.exe Token: SeDebugPrivilege 4376 taskkill.exe Token: SeDebugPrivilege 1104 taskkill.exe Token: SeDebugPrivilege 2228 taskkill.exe Token: SeDebugPrivilege 2880 taskkill.exe Token: SeDebugPrivilege 3996 taskkill.exe Token: SeDebugPrivilege 916 taskkill.exe Token: SeDebugPrivilege 3744 taskkill.exe Token: SeDebugPrivilege 3152 taskkill.exe Token: SeDebugPrivilege 2864 taskkill.exe Token: SeDebugPrivilege 1684 taskkill.exe Token: SeDebugPrivilege 8 powershell.exe Token: SeDebugPrivilege 1532 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1892 wrote to memory of 5596 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 1892 wrote to memory of 5596 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 1892 wrote to memory of 4960 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 1892 wrote to memory of 4960 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 1892 wrote to memory of 544 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 1892 wrote to memory of 544 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 1892 wrote to memory of 2620 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 1892 wrote to memory of 2620 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 1892 wrote to memory of 944 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 1892 wrote to memory of 944 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 1892 wrote to memory of 916 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 1892 wrote to memory of 916 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 1892 wrote to memory of 4660 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 1892 wrote to memory of 4660 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 1892 wrote to memory of 1452 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 1892 wrote to memory of 1452 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 1892 wrote to memory of 2640 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 1892 wrote to memory of 2640 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 1892 wrote to memory of 2056 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 1892 wrote to memory of 2056 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 1892 wrote to memory of 1868 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 1892 wrote to memory of 1868 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 1892 wrote to memory of 5432 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 1892 wrote to memory of 5432 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 1892 wrote to memory of 5096 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 1892 wrote to memory of 5096 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 1892 wrote to memory of 6076 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 1892 wrote to memory of 6076 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 1892 wrote to memory of 4440 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 1892 wrote to memory of 4440 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 1892 wrote to memory of 4552 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 1892 wrote to memory of 4552 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 1892 wrote to memory of 4560 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 1892 wrote to memory of 4560 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 1892 wrote to memory of 4544 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 1892 wrote to memory of 4544 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 1892 wrote to memory of 6080 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 1892 wrote to memory of 6080 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 1892 wrote to memory of 4944 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 1892 wrote to memory of 4944 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 1892 wrote to memory of 2896 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 1892 wrote to memory of 2896 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 1892 wrote to memory of 4720 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 1892 wrote to memory of 4720 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 1892 wrote to memory of 4508 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 1892 wrote to memory of 4508 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 1892 wrote to memory of 4596 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 1892 wrote to memory of 4596 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 1892 wrote to memory of 4608 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 1892 wrote to memory of 4608 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 1892 wrote to memory of 4652 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 1892 wrote to memory of 4652 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 1892 wrote to memory of 4728 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 1892 wrote to memory of 4728 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 1892 wrote to memory of 4768 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 1892 wrote to memory of 4768 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 1892 wrote to memory of 4992 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 136 PID 1892 wrote to memory of 4992 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 136 PID 1892 wrote to memory of 5024 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 137 PID 1892 wrote to memory of 5024 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 137 PID 1892 wrote to memory of 5028 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 138 PID 1892 wrote to memory of 5028 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 138 PID 1892 wrote to memory of 5048 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 139 PID 1892 wrote to memory of 5048 1892 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 139
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:5596
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:4960
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:544
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:2620
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:944
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:916
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2056
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5432
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6076
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4552
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6080
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:4608
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4652
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:4768
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5800
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5980
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3996
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5412
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3892
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5160
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3152
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5248
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3448
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:8
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:4764
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3424 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4388
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:2876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:6280
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:6576
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD542dddf0ba736d94e2ba45063ec95603a
SHA1180cf4bf796a8f5588637fac1de823c20d37c29f
SHA25621364529d34ac419918be8339fe1987713154097342ca1006e1fb8794b52753e
SHA5121ea7182364c4786d280423227596092dd1796711b45221dbacd6c6182edb546fe33510768949aacba12fb0982da532e1248ac98d9f6e489767b926b508a43e14
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD555343b64c2efd29435183de46a7f83a9
SHA1fcba71978c0d15b0e8f53f584b1fb51d45bd18ea
SHA256bb7b7d83e0592dd4eb2e7e78550c59892b6ffc3c8ba147b128ae90202c46cfc7
SHA51258377977e81effa330096989382a191d019bb9499269159af938abbe57c06ba12fd8eca866e569a3d820641a7a05ca53482161c466ac4d3b32037af70366d5c9
-
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Filesize804KB
MD59d9b8bdecf266a3aa34e2912c5283a6b
SHA119bc4af8af7f11e85f0c741f640c64de0ead2aea
SHA25664d82662a20d5e8c9bb6ed18817ea5b32052d7a57a546d50c7c07c7c0618009b
SHA5125eb8292e2379959483adf933e21f8805091f5b105ac34c918bc9e5c19cb2281a4e3744cc79bed26c253dd1d2edb4b45cc720f4fc9bae048681d7472dfef07b1f
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD565835cd6f819b01ddcf1b577c2f03c1d
SHA1ec579d423d8c213a1d24cf6233571f0906872fb3
SHA256614485933aafe0d920e6878fbd392aaf0f68270abd3cebfbe8ab1da808c5a02d
SHA51298759925c4aa464eed73a493e3263ce381a6d0016a1ed4e7c0f33d3895b55bc095e33de72ff64308abcd18e13b45b7d30da5960bb74f16919ac08e644629b2b4
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD54ae0041831adf6a347b9ef724a0e5e93
SHA1dbc15b27f3d342e29ff2099fdd9d227bc727784c
SHA256e8a952312dffb33aa1ff78e86a0d9cecccf49a203a038bc5abeaf193f91dbb9c
SHA512d5ea8817da8e3fc42875b35e8a12bc42969564aa6c3d807a3148c1d48b9a8dfe666fefd1ebd6ef036aa77718edd2ddd4ae5bc3347b741c59b4cb4872f3e8ba41
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5164a45e66dbe5b4c1fad9ced25394a84
SHA15f90cf92b891734679ddb12be560b2ec4c6282d7
SHA256e8f1393a9e1a21ef9c18231e6d1301624694e6036ec8ddf1234219eb96222a28
SHA512d05e8eebd235ed67a9a4c8f13004cf576df60ae068b81cd11a9d3de69cde110bf3983005a55adac948c5e8f5843b44c865b56dad4d8a37de3d2e442c4ef2eb55
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD5c1d636b89353b2cf6630c11ada009d8f
SHA1f834a52a7da5a450fd39dda383da5b18f3f5c1b1
SHA25681e623998840e149df4d548df59ccfce28f353f579c34c40a16d94ccbfa0ef26
SHA5120f5ddcd38d6847cb9c5c92f6f44928c6ee97e52c5430516faff4f7aa748d07ad904e023610558a04bd4a85d003462f8dd078a552aeb4d24379a0025b15e2864f