Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
97s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2025, 22:32
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-186956858-2143653872-2609589082-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2724 sc.exe 3164 sc.exe 2212 sc.exe 1776 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1740 PING.EXE 1572 cmd.exe -
Kills process with taskkill 47 IoCs
pid Process 1012 taskkill.exe 3720 taskkill.exe 4924 taskkill.exe 912 taskkill.exe 3028 taskkill.exe 1500 taskkill.exe 1336 taskkill.exe 1360 taskkill.exe 780 taskkill.exe 4296 taskkill.exe 3076 taskkill.exe 4200 taskkill.exe 1884 taskkill.exe 5004 taskkill.exe 4472 taskkill.exe 4860 taskkill.exe 4496 taskkill.exe 1316 taskkill.exe 3772 taskkill.exe 2572 taskkill.exe 3036 taskkill.exe 1072 taskkill.exe 4912 taskkill.exe 1312 taskkill.exe 5072 taskkill.exe 1504 taskkill.exe 1824 taskkill.exe 4816 taskkill.exe 4356 taskkill.exe 1816 taskkill.exe 4560 taskkill.exe 5036 taskkill.exe 400 taskkill.exe 2832 taskkill.exe 2188 taskkill.exe 1116 taskkill.exe 3640 taskkill.exe 4004 taskkill.exe 4024 taskkill.exe 2180 taskkill.exe 3168 taskkill.exe 2616 taskkill.exe 3188 taskkill.exe 4700 taskkill.exe 716 taskkill.exe 5048 taskkill.exe 2140 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5828 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1740 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 3168 taskkill.exe Token: SeDebugPrivilege 4004 taskkill.exe Token: SeDebugPrivilege 1816 taskkill.exe Token: SeDebugPrivilege 1072 taskkill.exe Token: SeDebugPrivilege 2188 taskkill.exe Token: SeDebugPrivilege 1316 taskkill.exe Token: SeDebugPrivilege 912 taskkill.exe Token: SeDebugPrivilege 2616 taskkill.exe Token: SeDebugPrivilege 4816 taskkill.exe Token: SeDebugPrivilege 780 taskkill.exe Token: SeDebugPrivilege 4296 taskkill.exe Token: SeDebugPrivilege 4924 taskkill.exe Token: SeDebugPrivilege 3028 taskkill.exe Token: SeDebugPrivilege 5036 taskkill.exe Token: SeDebugPrivilege 2140 taskkill.exe Token: SeDebugPrivilege 4860 taskkill.exe Token: SeDebugPrivilege 5048 taskkill.exe Token: SeDebugPrivilege 4912 taskkill.exe Token: SeDebugPrivilege 2180 taskkill.exe Token: SeDebugPrivilege 1504 taskkill.exe Token: SeDebugPrivilege 4200 taskkill.exe Token: SeDebugPrivilege 400 taskkill.exe Token: SeDebugPrivilege 1012 taskkill.exe Token: SeDebugPrivilege 3076 taskkill.exe Token: SeDebugPrivilege 4496 taskkill.exe Token: SeDebugPrivilege 3720 taskkill.exe Token: SeDebugPrivilege 4024 taskkill.exe Token: SeDebugPrivilege 3036 taskkill.exe Token: SeDebugPrivilege 5004 taskkill.exe Token: SeDebugPrivilege 4356 taskkill.exe Token: SeDebugPrivilege 1116 taskkill.exe Token: SeDebugPrivilege 1884 taskkill.exe Token: SeDebugPrivilege 4700 taskkill.exe Token: SeDebugPrivilege 1312 taskkill.exe Token: SeDebugPrivilege 716 taskkill.exe Token: SeDebugPrivilege 2832 taskkill.exe Token: SeDebugPrivilege 4472 taskkill.exe Token: SeDebugPrivilege 1824 taskkill.exe Token: SeDebugPrivilege 3640 taskkill.exe Token: SeDebugPrivilege 1336 taskkill.exe Token: SeDebugPrivilege 4560 taskkill.exe Token: SeDebugPrivilege 5072 taskkill.exe Token: SeDebugPrivilege 3772 taskkill.exe Token: SeDebugPrivilege 3188 taskkill.exe Token: SeDebugPrivilege 1500 taskkill.exe Token: SeDebugPrivilege 2572 taskkill.exe Token: SeDebugPrivilege 3572 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3944 wrote to memory of 1776 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 3944 wrote to memory of 1776 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 3944 wrote to memory of 2212 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 3944 wrote to memory of 2212 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 3944 wrote to memory of 3164 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 3944 wrote to memory of 3164 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 3944 wrote to memory of 2724 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 3944 wrote to memory of 2724 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 3944 wrote to memory of 2188 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 3944 wrote to memory of 2188 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 3944 wrote to memory of 1012 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 3944 wrote to memory of 1012 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 3944 wrote to memory of 4816 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 3944 wrote to memory of 4816 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 3944 wrote to memory of 1072 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 3944 wrote to memory of 1072 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 3944 wrote to memory of 1880 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 3944 wrote to memory of 1880 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 3944 wrote to memory of 3168 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 3944 wrote to memory of 3168 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 3944 wrote to memory of 400 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 3944 wrote to memory of 400 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 3944 wrote to memory of 3028 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 3944 wrote to memory of 3028 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 3944 wrote to memory of 3076 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 3944 wrote to memory of 3076 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 3944 wrote to memory of 3640 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 3944 wrote to memory of 3640 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 3944 wrote to memory of 2616 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 3944 wrote to memory of 2616 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 3944 wrote to memory of 4004 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 3944 wrote to memory of 4004 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 3944 wrote to memory of 5036 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 3944 wrote to memory of 5036 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 3944 wrote to memory of 1116 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 3944 wrote to memory of 1116 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 3944 wrote to memory of 4560 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 3944 wrote to memory of 4560 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 3944 wrote to memory of 4496 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 3944 wrote to memory of 4496 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 3944 wrote to memory of 780 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 3944 wrote to memory of 780 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 3944 wrote to memory of 912 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 3944 wrote to memory of 912 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 3944 wrote to memory of 4860 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 3944 wrote to memory of 4860 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 3944 wrote to memory of 4912 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 3944 wrote to memory of 4912 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 3944 wrote to memory of 4924 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 3944 wrote to memory of 4924 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 3944 wrote to memory of 1360 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 3944 wrote to memory of 1360 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 3944 wrote to memory of 4356 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 123 PID 3944 wrote to memory of 4356 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 123 PID 3944 wrote to memory of 1816 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 124 PID 3944 wrote to memory of 1816 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 124 PID 3944 wrote to memory of 3720 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 125 PID 3944 wrote to memory of 3720 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 125 PID 3944 wrote to memory of 4296 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 126 PID 3944 wrote to memory of 4296 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 126 PID 3944 wrote to memory of 1316 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 127 PID 3944 wrote to memory of 1316 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 127 PID 3944 wrote to memory of 1312 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 128 PID 3944 wrote to memory of 1312 3944 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 128
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:1776
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:2212
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:3164
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:2724
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1072
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:1880
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3168
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:400
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3076
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3640
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:780
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:912
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:1360
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1816
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3720
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4296
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3188
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4700
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:716
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1336
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3572
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:5828
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1572 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1740
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:6096
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:5824
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:5844
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD55d6d445d605042104e816f19992f3b42
SHA12d0776450ba471f1c7f1b929bd2b63207213c91d
SHA256a164f8665b70055c4b01a2d25ad2b19993efad0b65c41312a2dbd8b909587ea9
SHA51242ee5fd85d10b7d77f35edb894692cea1aaef52b3301d459ae8b071c0c9d2133d1e99eb65f619f39b3067d68a058d5fe0d3b7d4ee1509be9c233400806ba0e9a
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD5e64599cf98f8af6e02e0f7bf7f039433
SHA1f0a742d57b02df3ad5c7827e9142dd60eeb08f57
SHA2561bb9cf6ea94a73168b1bd63fdc76e513c1284ec6edb9812b87aa708b286a93f5
SHA5129465c46726109a1b7f86de6da2cfbd58d3a0ece129b9986ca86a450b3f479f386bc44d95ea4ee448377e1fb2f2173b65756711937fb3fb44a49d8d52aa128190
-
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Filesize804KB
MD5544faeea39e5f3eb31510d966a3def68
SHA194fe05e0eba2ebd2a1ab0b90aea25ac2b598ecdc
SHA256868055210013690ff9ec90704613bdec65568a7b0bca533b01ac38aba24abf35
SHA5121b441f59c8bc5330c882857f38a1a84f5435a54d25aad7d0e35f078df43dee08730e485837d872b0fe4f7b4ed3a30c6c523c84365686253f70b48e4a53be12b8
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD588183a0cb115fd500d193dcca54e677d
SHA1f097225f23a9e920535c16be28784e126becc0d1
SHA256491e40987af0e3aaf76d1bc29f86c165ddd4efe2254facb033641e023d68a437
SHA51287decf756e3951274b0a128c8e943ecf271c16032418422e14b548031808de1497745afbc170d67d3f0afe2f9bd9289b5a28aa49a21c124502ce34e69ce224f8
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD53a6f9e5b7b43f6e77b85b1b0c58b4ac9
SHA128617e8120a0ac8f836f321c2c78b5475dfd7576
SHA25620cd32b40f45d79ba104594e509dd85a109dd08b899a829dbfdff22c4279098b
SHA512d23f8ee5b8a11e2543ac75a69decb2de68f50d93007496e58f78e9e1b6837fb1e3cc598d5a999c87a42080f2047ac9c77dc8857933854479092784ed6af5146c
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d8c29ea1bc8dbf75da42cf6ed688d9e3
SHA1572ef3fcdca764b8f924e7875b76a5ee13064630
SHA2562d80a98589acc4a2f3b6d3ac4d5a6a079b75b0be8131f1c140593e64ae446a53
SHA512fca7810cd1111336f5ff7105f3b3a8b2c5d1fc125265726b9f97ca9e1344b698fc53d4b02e77fcc0a3b5948fedf5a4087ebbb763ddaf25d04ec897e4eca07bd6
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD57af773d5db07a1a82c2da48e316ebeec
SHA1bb3d058fa40e73e01d64b42546ce5db112e6831f
SHA25676e305451e4780b9219c1d1e121c6a190e31784b13a0217dd282b4287502416a
SHA51213369245c0dda21023fd17b98f63aa47214ee467499f1af821ba9b539bcf472151bec0fe29024e2f9edac29233c7ec2fbe851cdd65cefc9f3cc004c0a2c13706