Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
731.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
7c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
109s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2025, 20:22
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4976 sc.exe 776 sc.exe 4920 sc.exe 3036 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5584 cmd.exe 5936 PING.EXE -
Kills process with taskkill 47 IoCs
pid Process 1520 taskkill.exe 4112 taskkill.exe 1700 taskkill.exe 1364 taskkill.exe 4568 taskkill.exe 4168 taskkill.exe 4072 taskkill.exe 4892 taskkill.exe 1508 taskkill.exe 1996 taskkill.exe 4640 taskkill.exe 1068 taskkill.exe 3928 taskkill.exe 4616 taskkill.exe 4488 taskkill.exe 4060 taskkill.exe 3992 taskkill.exe 1164 taskkill.exe 2928 taskkill.exe 3336 taskkill.exe 4912 taskkill.exe 732 taskkill.exe 4564 taskkill.exe 1680 taskkill.exe 1740 taskkill.exe 2008 taskkill.exe 2252 taskkill.exe 2828 taskkill.exe 2664 taskkill.exe 1416 taskkill.exe 1632 taskkill.exe 5084 taskkill.exe 1016 taskkill.exe 1512 taskkill.exe 1864 taskkill.exe 2356 taskkill.exe 2100 taskkill.exe 220 taskkill.exe 3240 taskkill.exe 4480 taskkill.exe 1620 taskkill.exe 684 taskkill.exe 640 taskkill.exe 3556 taskkill.exe 2288 taskkill.exe 2732 taskkill.exe 1664 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 7028 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5936 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 2252 taskkill.exe Token: SeDebugPrivilege 1996 taskkill.exe Token: SeDebugPrivilege 4568 taskkill.exe Token: SeDebugPrivilege 3336 taskkill.exe Token: SeDebugPrivilege 1520 taskkill.exe Token: SeDebugPrivilege 1632 taskkill.exe Token: SeDebugPrivilege 2288 taskkill.exe Token: SeDebugPrivilege 4640 taskkill.exe Token: SeDebugPrivilege 2732 taskkill.exe Token: SeDebugPrivilege 4892 taskkill.exe Token: SeDebugPrivilege 4480 taskkill.exe Token: SeDebugPrivilege 1416 taskkill.exe Token: SeDebugPrivilege 732 taskkill.exe Token: SeDebugPrivilege 1068 taskkill.exe Token: SeDebugPrivilege 3928 taskkill.exe Token: SeDebugPrivilege 684 taskkill.exe Token: SeDebugPrivilege 1740 taskkill.exe Token: SeDebugPrivilege 4912 taskkill.exe Token: SeDebugPrivilege 1664 taskkill.exe Token: SeDebugPrivilege 2928 taskkill.exe Token: SeDebugPrivilege 640 taskkill.exe Token: SeDebugPrivilege 1864 taskkill.exe Token: SeDebugPrivilege 1164 taskkill.exe Token: SeDebugPrivilege 1512 taskkill.exe Token: SeDebugPrivilege 220 taskkill.exe Token: SeDebugPrivilege 4488 taskkill.exe Token: SeDebugPrivilege 1620 taskkill.exe Token: SeDebugPrivilege 1364 taskkill.exe Token: SeDebugPrivilege 1508 taskkill.exe Token: SeDebugPrivilege 1700 taskkill.exe Token: SeDebugPrivilege 2356 taskkill.exe Token: SeDebugPrivilege 5084 taskkill.exe Token: SeDebugPrivilege 2828 taskkill.exe Token: SeDebugPrivilege 4060 taskkill.exe Token: SeDebugPrivilege 2008 taskkill.exe Token: SeDebugPrivilege 4112 taskkill.exe Token: SeDebugPrivilege 2664 taskkill.exe Token: SeDebugPrivilege 1680 taskkill.exe Token: SeDebugPrivilege 3240 taskkill.exe Token: SeDebugPrivilege 4168 taskkill.exe Token: SeDebugPrivilege 2100 taskkill.exe Token: SeDebugPrivilege 4072 taskkill.exe Token: SeDebugPrivilege 3556 taskkill.exe Token: SeDebugPrivilege 4616 taskkill.exe Token: SeDebugPrivilege 1016 taskkill.exe Token: SeDebugPrivilege 4564 taskkill.exe Token: SeDebugPrivilege 1720 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2588 wrote to memory of 4920 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 2588 wrote to memory of 4920 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 2588 wrote to memory of 776 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 2588 wrote to memory of 776 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 2588 wrote to memory of 4976 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 2588 wrote to memory of 4976 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 2588 wrote to memory of 3036 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 2588 wrote to memory of 3036 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 2588 wrote to memory of 732 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 2588 wrote to memory of 732 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 2588 wrote to memory of 1632 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 2588 wrote to memory of 1632 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 2588 wrote to memory of 4892 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 2588 wrote to memory of 4892 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 2588 wrote to memory of 4072 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 2588 wrote to memory of 4072 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 2588 wrote to memory of 4168 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 2588 wrote to memory of 4168 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 2588 wrote to memory of 2100 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 2588 wrote to memory of 2100 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 2588 wrote to memory of 4912 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 2588 wrote to memory of 4912 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 2588 wrote to memory of 3336 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 2588 wrote to memory of 3336 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 2588 wrote to memory of 1664 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 2588 wrote to memory of 1664 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 2588 wrote to memory of 2928 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 2588 wrote to memory of 2928 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 2588 wrote to memory of 1164 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 2588 wrote to memory of 1164 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 2588 wrote to memory of 4568 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 2588 wrote to memory of 4568 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 2588 wrote to memory of 640 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 2588 wrote to memory of 640 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 2588 wrote to memory of 1364 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 2588 wrote to memory of 1364 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 2588 wrote to memory of 2252 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 2588 wrote to memory of 2252 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 2588 wrote to memory of 4616 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 2588 wrote to memory of 4616 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 2588 wrote to memory of 3928 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 2588 wrote to memory of 3928 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 2588 wrote to memory of 1068 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 2588 wrote to memory of 1068 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 2588 wrote to memory of 1416 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 2588 wrote to memory of 1416 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 2588 wrote to memory of 2008 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 2588 wrote to memory of 2008 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 2588 wrote to memory of 3992 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 2588 wrote to memory of 3992 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 2588 wrote to memory of 1700 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 2588 wrote to memory of 1700 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 2588 wrote to memory of 2732 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 2588 wrote to memory of 2732 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 2588 wrote to memory of 4640 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 2588 wrote to memory of 4640 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 2588 wrote to memory of 2356 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 2588 wrote to memory of 2356 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 2588 wrote to memory of 2664 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 2588 wrote to memory of 2664 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 2588 wrote to memory of 1740 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 2588 wrote to memory of 1740 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 2588 wrote to memory of 4112 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 2588 wrote to memory of 4112 2588 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:4920
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:776
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:4976
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:3036
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:732
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3336
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4568
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1416
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:3992
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:684
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3240
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:4680
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:7028
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:5584 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5936
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:5164
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:7040
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2656
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD59dd243103d28e0815d12fac6c4fc77a0
SHA1962b9bfc50f2a9560d8853e8b62b62818c33e90d
SHA2568ec15d4bbb7592d16d9bcf58d2f2cdf88f9a2f3ca777d01c2b7979d20ce2f00c
SHA512f144510540ec896c0b330c2729f590d8e2eb65cdebc6298e414658fba87f37b16605bf4ddb8785d876d7701829e5c7a18b1492b1e274656eea1e92ff17cb8019
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD5ff1c9d1b9620791f622c890c06cf85a0
SHA1b93a3a33deb484fc7e05841b158f56142c77788e
SHA256be52d949dabfc87aa738b489f05d81aca570fc74e2bf45691622809bee945ef3
SHA51263e5402eb24b52ccccc742d5c64f8e8eccec78102a722c0f0e96129a812e7202a95f6a17848b7e4a627e33c4a7d6840ae47b185aba30a0d5c32b6013e24644a3
-
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Filesize804KB
MD52d9970602ee1af2dbbf891ccce6fbc23
SHA1df67fc2d8a274ac2f9fcd4861de3d656ce1d8d00
SHA2560d6bd4482b8449ff0cca52644df50813dab2d89b49ebe80ddaa20c2c4153752c
SHA5122b70299d493dcb829a2b47f5250ee242e29c5d0b3d8460c7c9d373dcb54165acb1e9b61756da9862f23d964a251147d7b10b4cbb7b762ed77a4dc5f567539e82
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD504269d089ff5d5de1a2d20f14ea59438
SHA1ad75c240e3790a717489ce71171ab778dd35786d
SHA25636203c4f3c25bfee17a9de55ccd29429b4029149e71b18e81ecc489b0ccbe0f8
SHA512ca1a5f00cff3d055a7608913f9e212dd7b850f4f792c9e884bd61e2e6338f5f05e29b134f259364fde7ffb67300325d10fb756a6bc647a17c0198694f3a27a95
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD5efc02e18949a0473f087674823d45de7
SHA1970d300da1f8498aef01cae76e9ffe319921fbd2
SHA25646b9b12c6f2017ea5d3f203a2a090272787b7d5dfb785a3449a337c46082b2bb
SHA512291480999ed11ecf7a1d6fe3274d72d83066d80f1c8f448f8c2445c0c336451622b9110820708f800f5fcf01ccfc65a4f8c40b98dca8bcd82b22e327803b71eb
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD54d0d1d55134a828929a23eb352395c1e
SHA1b91ee61740ec9ef8f389bd4d47e7249a3fe8e71c
SHA25689f288cd40a7ee0c206a8b966ddc5f5a4876442ad7568ae90a6ed4f8faedec9c
SHA512b4ce70106f559d14e2ddd19c97f67208f9cb5ce3603dd11d31de7b9fb39536473350c8eda781fa5ba2c8923baaff337245183b2070a2e5b993726c2818e12fb7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD50b54a4101b3539e9efe4474124cd534b
SHA1326d19a15b445e59d80d18b118c020b277bf87fa
SHA256536f43de722e965054b6516abe26c6985420c41734cc5bcafaa5fb55b35fad30
SHA5125b8bff7e266a89da1d770cddb2aafd1091ed9691b410fe7a441452020eab657c80a97631cfc2320e4b2b38e42614c79284a12331afabac630d1ca7908a5e144a