Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
731.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
10Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
102s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2025, 20:42
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2592 sc.exe 2000 sc.exe 5860 sc.exe 1592 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3172 cmd.exe 3640 PING.EXE -
Kills process with taskkill 47 IoCs
pid Process 2616 taskkill.exe 5568 taskkill.exe 2644 taskkill.exe 5324 taskkill.exe 2524 taskkill.exe 2372 taskkill.exe 5400 taskkill.exe 5316 taskkill.exe 5268 taskkill.exe 1596 taskkill.exe 3908 taskkill.exe 2224 taskkill.exe 2816 taskkill.exe 4292 taskkill.exe 2428 taskkill.exe 6128 taskkill.exe 5300 taskkill.exe 2784 taskkill.exe 2052 taskkill.exe 976 taskkill.exe 3540 taskkill.exe 4784 taskkill.exe 3228 taskkill.exe 1096 taskkill.exe 2624 taskkill.exe 5440 taskkill.exe 2204 taskkill.exe 6116 taskkill.exe 2556 taskkill.exe 5496 taskkill.exe 2364 taskkill.exe 3192 taskkill.exe 5012 taskkill.exe 5112 taskkill.exe 388 taskkill.exe 2664 taskkill.exe 2476 taskkill.exe 1004 taskkill.exe 4320 taskkill.exe 2300 taskkill.exe 4608 taskkill.exe 5352 taskkill.exe 972 taskkill.exe 5516 taskkill.exe 5432 taskkill.exe 5584 taskkill.exe 4648 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4512 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3640 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 2204 taskkill.exe Token: SeDebugPrivilege 2784 taskkill.exe Token: SeDebugPrivilege 5352 taskkill.exe Token: SeDebugPrivilege 2624 taskkill.exe Token: SeDebugPrivilege 4648 taskkill.exe Token: SeDebugPrivilege 5568 taskkill.exe Token: SeDebugPrivilege 3908 taskkill.exe Token: SeDebugPrivilege 5012 taskkill.exe Token: SeDebugPrivilege 2052 taskkill.exe Token: SeDebugPrivilege 3192 taskkill.exe Token: SeDebugPrivilege 6116 taskkill.exe Token: SeDebugPrivilege 2664 taskkill.exe Token: SeDebugPrivilege 1004 taskkill.exe Token: SeDebugPrivilege 388 taskkill.exe Token: SeDebugPrivilege 2364 taskkill.exe Token: SeDebugPrivilege 1596 taskkill.exe Token: SeDebugPrivilege 5440 taskkill.exe Token: SeDebugPrivilege 4608 taskkill.exe Token: SeDebugPrivilege 2476 taskkill.exe Token: SeDebugPrivilege 1096 taskkill.exe Token: SeDebugPrivilege 2372 taskkill.exe Token: SeDebugPrivilege 5496 taskkill.exe Token: SeDebugPrivilege 5112 taskkill.exe Token: SeDebugPrivilege 972 taskkill.exe Token: SeDebugPrivilege 2816 taskkill.exe Token: SeDebugPrivilege 6128 taskkill.exe Token: SeDebugPrivilege 5300 taskkill.exe Token: SeDebugPrivilege 3228 taskkill.exe Token: SeDebugPrivilege 2644 taskkill.exe Token: SeDebugPrivilege 4292 taskkill.exe Token: SeDebugPrivilege 5516 taskkill.exe Token: SeDebugPrivilege 3540 taskkill.exe Token: SeDebugPrivilege 5576 powershell.exe Token: SeDebugPrivilege 2616 taskkill.exe Token: SeDebugPrivilege 2224 taskkill.exe Token: SeDebugPrivilege 4320 taskkill.exe Token: SeDebugPrivilege 5400 taskkill.exe Token: SeDebugPrivilege 2428 taskkill.exe Token: SeDebugPrivilege 5316 taskkill.exe Token: SeDebugPrivilege 5268 taskkill.exe Token: SeDebugPrivilege 5432 taskkill.exe Token: SeDebugPrivilege 4784 taskkill.exe Token: SeDebugPrivilege 976 taskkill.exe Token: SeDebugPrivilege 2300 taskkill.exe Token: SeDebugPrivilege 2556 taskkill.exe Token: SeDebugPrivilege 2524 taskkill.exe Token: SeDebugPrivilege 5324 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 244 wrote to memory of 1592 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 244 wrote to memory of 1592 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 244 wrote to memory of 5860 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 244 wrote to memory of 5860 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 244 wrote to memory of 2000 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 244 wrote to memory of 2000 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 244 wrote to memory of 2592 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 244 wrote to memory of 2592 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 244 wrote to memory of 2624 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 244 wrote to memory of 2624 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 244 wrote to memory of 2784 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 244 wrote to memory of 2784 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 244 wrote to memory of 2664 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 244 wrote to memory of 2664 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 244 wrote to memory of 388 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 244 wrote to memory of 388 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 244 wrote to memory of 1596 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 244 wrote to memory of 1596 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 244 wrote to memory of 5568 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 244 wrote to memory of 5568 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 244 wrote to memory of 5012 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 244 wrote to memory of 5012 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 244 wrote to memory of 5352 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 244 wrote to memory of 5352 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 244 wrote to memory of 6116 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 244 wrote to memory of 6116 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 99 PID 244 wrote to memory of 3192 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 244 wrote to memory of 3192 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 244 wrote to memory of 2364 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 244 wrote to memory of 2364 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 244 wrote to memory of 2204 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 244 wrote to memory of 2204 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 244 wrote to memory of 2052 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 244 wrote to memory of 2052 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 244 wrote to memory of 4648 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 244 wrote to memory of 4648 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 244 wrote to memory of 5440 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 244 wrote to memory of 5440 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 244 wrote to memory of 1004 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 244 wrote to memory of 1004 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 244 wrote to memory of 2476 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 244 wrote to memory of 2476 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 244 wrote to memory of 4608 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 128 PID 244 wrote to memory of 4608 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 128 PID 244 wrote to memory of 4528 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 244 wrote to memory of 4528 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 244 wrote to memory of 3908 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 132 PID 244 wrote to memory of 3908 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 132 PID 244 wrote to memory of 5496 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 135 PID 244 wrote to memory of 5496 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 135 PID 244 wrote to memory of 5584 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 136 PID 244 wrote to memory of 5584 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 136 PID 244 wrote to memory of 5300 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 137 PID 244 wrote to memory of 5300 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 137 PID 244 wrote to memory of 5112 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 138 PID 244 wrote to memory of 5112 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 138 PID 244 wrote to memory of 5268 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 139 PID 244 wrote to memory of 5268 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 139 PID 244 wrote to memory of 5316 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 140 PID 244 wrote to memory of 5316 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 140 PID 244 wrote to memory of 6128 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 141 PID 244 wrote to memory of 6128 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 141 PID 244 wrote to memory of 5432 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 142 PID 244 wrote to memory of 5432 244 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:1592
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:5860
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:2000
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:2592
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:388
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5568
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5352
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6116
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5440
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1004
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4608
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:4528
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5496
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:5584
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5300
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5268
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5316
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6128
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5432
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5516
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5400
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4292
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5324
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4784
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:976
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3540
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:972
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5576
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:4512
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3172 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3640
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:2636
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:5596
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3540
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5f9e346e27e84e4cf4cb63580ba2f362a
SHA15f59fb0fbfa45c580db5e8128836c9cb1aec5663
SHA256aed6d9b9a9348088f25b4441c87db4ae7ea822b0c4f130a1d2237bc37ae2026f
SHA512a45b3467a53723603baabbfc5704e9dbf4de5716315388afb3bc00121c6f58c28a10710aa93f08f0180752d3ca03ee4c52d881d181e9af9efcf261e4cce0a77f
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD576de2445fa4353bb9398e61973b463b2
SHA1df41f213eb3ab49ca27a42306b6c5ad97d8831e4
SHA256a510a5524447e798da30a7267fa31bdec57a49b87e8a9fc20d57e12aa1729df4
SHA51265ba92b0929e3c51ffb19e2d25f25f112f000c54479f4f427e14d9c49b07e5c6c177debdc50fba8b29d049b95dfbbaee6f904a0225c7596379fbca9c3a9b7cce
-
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Filesize804KB
MD54845c700e57c56685f821f3afb48c0e4
SHA15e73aec0d1ed303526981260813832297b86f00d
SHA2566d89f35d0dea0209cbd333ddc4da736c1ddeaa996c88b7ba47c9b3b54514a826
SHA512bf11165da68c1de10be6af5886b4144590f7ec68927819debace45d4028cdc6d5fc78e06a5783f87c9dc57379d542cf113fd9c65fd47a06a17b924940298233f
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD5fe46e328602fbdd4f8a68b13d931baed
SHA17a260a7ed7b9314abd5c75e8e623ae4b0aad7a47
SHA2561be36c2949732e7bcc524109e4f160b8a033e9eb9dd9bccb899a16c1603cef12
SHA51263bd9566c831e4a0c06eded1f25f6c8e4c26fedbd4726a2a88693fa191becf50e3febf8775c4c079fc152df46ec84e273aa1a2daab01946c566102194e05ded1
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD5dbff9547ff1bf1d7dca45556b8e613f4
SHA109d622ca4ad40884d9ccc651677f69f1a8b5e9a3
SHA2562c1dedc61f593d944ae866b2aa42cb20b820e69532cba3dc137537eb16312b3a
SHA512916a488e5e9ad585a8eaa3ecaaca5454de23b6cb3da2b64c109ec7a8c9d52a21a0acd512a35fb0acd7dce601d63a34b227e9147a53ae60dea92221a13cd65971
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD57cfa57226f15f18e8c29720a8a6efc8b
SHA1fef3b41b9715cd37a0bb9ab323fc9aa62158d55b
SHA25653d11cfbf4bbedac6a4963cbe63d8f500f1cfd159e1b9c24149c855d3be188eb
SHA512d6ea186fa684b2ca04eb5d9292a5d60b4d22f03205eb0bbe51c8715e1312e2179bc6da60c7763cb7663cd967fc761b9bd8d9949b009e2e6cba51883a167d1820
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD54fc8a9edfbe2269cc04d1a2738d2fe03
SHA1aeb9003918634cb826b9332d778fc4ba808a7267
SHA2566ab4d9a738da39c02d15be4a9c96286cf9829d06846ba43ab5d8b7f5c32d872c
SHA512947067230043ad6952498c531225f9c6f74215bacfcd096931fabb09ad918a1b850ad7b41ab80ab3a2846203b63dd16782cea2b9a4f0a82f6920b002b0c09b08