Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
731.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
103s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2025, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1416 sc.exe 1440 sc.exe 3104 sc.exe 5440 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2156 cmd.exe 5348 PING.EXE -
Kills process with taskkill 47 IoCs
pid Process 5616 taskkill.exe 4740 taskkill.exe 3304 taskkill.exe 5312 taskkill.exe 3948 taskkill.exe 3504 taskkill.exe 1256 taskkill.exe 4632 taskkill.exe 2264 taskkill.exe 4748 taskkill.exe 1088 taskkill.exe 2028 taskkill.exe 2568 taskkill.exe 808 taskkill.exe 4068 taskkill.exe 5124 taskkill.exe 3728 taskkill.exe 864 taskkill.exe 3924 taskkill.exe 3416 taskkill.exe 3700 taskkill.exe 2152 taskkill.exe 5888 taskkill.exe 3828 taskkill.exe 3284 taskkill.exe 4580 taskkill.exe 2408 taskkill.exe 2092 taskkill.exe 2800 taskkill.exe 3116 taskkill.exe 1916 taskkill.exe 4680 taskkill.exe 5348 taskkill.exe 3656 taskkill.exe 6028 taskkill.exe 2108 taskkill.exe 5568 taskkill.exe 4968 taskkill.exe 3672 taskkill.exe 5324 taskkill.exe 4108 taskkill.exe 3712 taskkill.exe 2160 taskkill.exe 2892 taskkill.exe 4440 taskkill.exe 464 taskkill.exe 4732 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4976 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5348 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 6028 taskkill.exe Token: SeDebugPrivilege 5568 taskkill.exe Token: SeDebugPrivilege 4108 taskkill.exe Token: SeDebugPrivilege 1256 taskkill.exe Token: SeDebugPrivilege 3728 taskkill.exe Token: SeDebugPrivilege 864 taskkill.exe Token: SeDebugPrivilege 2264 taskkill.exe Token: SeDebugPrivilege 4968 taskkill.exe Token: SeDebugPrivilege 4748 taskkill.exe Token: SeDebugPrivilege 5324 taskkill.exe Token: SeDebugPrivilege 2160 taskkill.exe Token: SeDebugPrivilege 5348 taskkill.exe Token: SeDebugPrivilege 4740 taskkill.exe Token: SeDebugPrivilege 3416 taskkill.exe Token: SeDebugPrivilege 1916 taskkill.exe Token: SeDebugPrivilege 2568 taskkill.exe Token: SeDebugPrivilege 4580 taskkill.exe Token: SeDebugPrivilege 2152 taskkill.exe Token: SeDebugPrivilege 2408 taskkill.exe Token: SeDebugPrivilege 3948 taskkill.exe Token: SeDebugPrivilege 2800 taskkill.exe Token: SeDebugPrivilege 3672 taskkill.exe Token: SeDebugPrivilege 2108 taskkill.exe Token: SeDebugPrivilege 5124 taskkill.exe Token: SeDebugPrivilege 4632 taskkill.exe Token: SeDebugPrivilege 808 taskkill.exe Token: SeDebugPrivilege 5312 taskkill.exe Token: SeDebugPrivilege 4068 taskkill.exe Token: SeDebugPrivilege 2092 taskkill.exe Token: SeDebugPrivilege 2892 taskkill.exe Token: SeDebugPrivilege 3504 taskkill.exe Token: SeDebugPrivilege 3700 taskkill.exe Token: SeDebugPrivilege 1088 taskkill.exe Token: SeDebugPrivilege 2028 taskkill.exe Token: SeDebugPrivilege 3828 taskkill.exe Token: SeDebugPrivilege 1900 powershell.exe Token: SeDebugPrivilege 4440 taskkill.exe Token: SeDebugPrivilege 5888 taskkill.exe Token: SeDebugPrivilege 3304 taskkill.exe Token: SeDebugPrivilege 3924 taskkill.exe Token: SeDebugPrivilege 3116 taskkill.exe Token: SeDebugPrivilege 3712 taskkill.exe Token: SeDebugPrivilege 4680 taskkill.exe Token: SeDebugPrivilege 3284 taskkill.exe Token: SeDebugPrivilege 464 taskkill.exe Token: SeDebugPrivilege 5616 taskkill.exe Token: SeDebugPrivilege 4732 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4376 wrote to memory of 5440 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 4376 wrote to memory of 5440 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 4376 wrote to memory of 3104 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 4376 wrote to memory of 3104 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 4376 wrote to memory of 1440 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 4376 wrote to memory of 1440 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 4376 wrote to memory of 1416 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 4376 wrote to memory of 1416 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 4376 wrote to memory of 6028 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 4376 wrote to memory of 6028 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 4376 wrote to memory of 2568 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 4376 wrote to memory of 2568 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 4376 wrote to memory of 1916 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 4376 wrote to memory of 1916 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 4376 wrote to memory of 2028 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 4376 wrote to memory of 2028 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 4376 wrote to memory of 3828 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 4376 wrote to memory of 3828 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 4376 wrote to memory of 3948 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 4376 wrote to memory of 3948 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 4376 wrote to memory of 3700 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 4376 wrote to memory of 3700 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 4376 wrote to memory of 2892 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 4376 wrote to memory of 2892 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 4376 wrote to memory of 5312 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 4376 wrote to memory of 5312 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 4376 wrote to memory of 3304 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 4376 wrote to memory of 3304 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 4376 wrote to memory of 2160 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 4376 wrote to memory of 2160 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 4376 wrote to memory of 3712 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 4376 wrote to memory of 3712 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 4376 wrote to memory of 3924 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 4376 wrote to memory of 3924 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 4376 wrote to memory of 4108 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 4376 wrote to memory of 4108 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 4376 wrote to memory of 1088 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 4376 wrote to memory of 1088 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 4376 wrote to memory of 3116 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 4376 wrote to memory of 3116 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 4376 wrote to memory of 5888 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 4376 wrote to memory of 5888 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 4376 wrote to memory of 4440 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 4376 wrote to memory of 4440 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 4376 wrote to memory of 864 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 4376 wrote to memory of 864 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 4376 wrote to memory of 2800 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 4376 wrote to memory of 2800 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 4376 wrote to memory of 3656 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 4376 wrote to memory of 3656 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 4376 wrote to memory of 2092 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 4376 wrote to memory of 2092 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 4376 wrote to memory of 5324 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 4376 wrote to memory of 5324 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 4376 wrote to memory of 3728 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 4376 wrote to memory of 3728 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 4376 wrote to memory of 5348 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 4376 wrote to memory of 5348 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 4376 wrote to memory of 5124 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 4376 wrote to memory of 5124 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 4376 wrote to memory of 5616 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 4376 wrote to memory of 5616 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 4376 wrote to memory of 2408 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 4376 wrote to memory of 2408 4376 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:5440
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:3104
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:1440
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:1416
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6028
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3828
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3948
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5312
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3304
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1088
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3116
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5888
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:864
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:3656
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5324
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5348
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5124
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5616
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4068
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5568
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1256
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3504
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3284
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:464
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4732
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4748
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3416
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:3000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:4976
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2156 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5348
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:2204
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:5332
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2076
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5866c052a71eb702458034c52df9eeace
SHA1ec5a5f0acb82e9015e56b18dc31fac8a2117d947
SHA2562b19eca12bc4afb42c8dbf04b81bd0bfdd27fe1a7894f59eb4a90656653f2ff4
SHA5124b94831581b7fd872519d7c38847a3dbb6b8387a9a83c9a8394669bcf9a0cc5a76c5736a01393a707b6b01d6f66133baa050928785149a075d98dc6f037b2bf0
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD5692b55e7e57ce554a1e9fed6a493d9d8
SHA116ddacc98779b07285585d10b02a7799e660be31
SHA25612b92300051f100617fed16b21ded3b84c3e05eaa992661621e368abf77e2dc5
SHA51201189d49d1d193afc63bdf22636bbbc83549aa5e4710314ba7cd38cd4dd284cbe94c3a0af5e3cc69c833c8460cca871367a24c3035fa04fa0b65c55dc046e9d7
-
C:\ProgramData\Package Cache\{2BB73336-4F69-4141-9797-E9BD6FE3980A}v64.8.8795\dotnet-host-8.0.2-win-x64.msi.energy[[email protected]]
Filesize728KB
MD53be47d4f6569cbd3ac75ef2d5e657090
SHA102d3196b85caa38a2a9623e46f018b3b5efd712c
SHA25663cedadeb0aad6074ef8e0f1ba08dde437cc649cf67cbeb2d808ba5e6bd71552
SHA512016e7b90bc88e679cc607ae2279926582a5d9bcf44e8a1e9a9c244f67c39f4d80534716b9fc54e4d4a9f6f46d39fbc18040a32b08b574ff4dd954c9bb8eb7d7f
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD5aa2153406b19d258cc49c90097368da3
SHA1c7a91f346b9d1da66aff021a74554ebab0382183
SHA2563ac7e79275e78a2330221a75c9bc2a13b7a5cfe682c9955857901917bd336faf
SHA5122308130899ada74c39069743534a8269205d5e17b5cf4c63ebde6b4fd85255380bdad7ff2850ae0c8cb329fd40ac8d1d7304a3cb846c769b152923652e0a10ea
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD571417092a1a57359141ef60a20623b6f
SHA10278fcb9608256aed20f66e0e3f24ea9012f98af
SHA256bef626b11f01e92627faa3f2733014572a1d834005c2d3a2e7d0f5d37828c5f7
SHA512bd9ec45f237e439415dfb35a1aea3293c39240aadff98304efe7aa618d54483d319af34ede167b252348dcf1e860d6ee96cd3282d7445f1c9d2aedb1eba62be4
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD55f3d606f9a5f1201bfc1f01c54e842c4
SHA1f1917e50b557b135953ecbe63e1fc1e675b541f1
SHA256dcc09d3b5b17ef60cb35e4148230306cdcd68d18d18a39fd5fe220c34997a32a
SHA512d85e1e1b4a552a8cdd21c4195a2ea082d3fcb40907d2a6a0ceb297f32defd1fba17d3b54dc954c26b3b731bc179bee5cfc011de3c667af47cdbe289b30fdfb38
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD51d976ac9c9d0fab86d3db0697b61f665
SHA191baddfe4cce9ed5a7ef61180eaa51c147c746c7
SHA256cbce1ce3c9e29927995732871c0b10adae1fb578c7ec2ddb06c2d12f3591ab95
SHA51285b5b653860ad00a4e01d7b10f8b9c680969bc8a92e5a75f5982663e19d6c8656cf7d55cd0a72ac7dd3a1aff3b019ed4f9624adb38d5270b4bc4660c072ab0f5