Analysis
-
max time kernel
67s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18/02/2025, 03:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe
-
Size
418KB
-
MD5
b97812a2e6be54e725defbab88357fa2
-
SHA1
29baab2551064fa30fb18955ccc8f332bd68ddd4
-
SHA256
b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32
-
SHA512
922e875633f1ebb3168a1c67d6e6b0571c97a33e4f1b88a6be5fb62e2e817107d1efdbcbbf5153532f41d835a435e49df1d011e9c8b9006054ddf34da43a620a
-
SSDEEP
12288:FnvxplpMAX99S4B009MqyQMKNT7lVfAD8xE:FvxplpMAtU4Bl9MdQFT7lVIoS
Score
10/10
Malware Config
Extracted
Path
C:\Program Files (x86)\readme.txt
Family
dragonforce
Ransom Note
Hello!
Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.
--- Our communication process:
1. You contact us.
2. We send you a list of files that were stolen.
3. We decrypt 1 file to confirm that our decryptor works.
4. We agree on the amount, which must be paid using BTC.
5. We delete your files, we give you a decryptor.
6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future.
--- Client area (use this site to contact us):
Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
>>> Use this ID: 81F2B1C14220E50881F2B1C14220E508 to begin the recovery process.
* In order to access the site, you will need Tor Browser,
you can download it from this link: https://www.torproject.org/
--- Additional contacts:
Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20
--- Recommendations:
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
--- Important:
If you refuse to pay or do not get in touch with us, we start publishing your files.
24/11/2024 00:00 UTC the decryptor will be destroyed and the files will be published on our blog.
Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
URLs
http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Signatures
-
DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
-
Dragonforce family
-
Drops desktop.ini file(s) 21 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Music\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Links\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Videos\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\LICENSE b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLFLTR.DAT b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Mozilla Firefox\defaultagent_localized.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\System\ado\msado27.tlb b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DW\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\eula.rtf b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VisioCustom.propdesc b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.GIF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\MergeWatch.midi b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files (x86)\Uninstall Information\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Microsoft Games\Purble Place\de-DE\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\default.vlt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files (x86)\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files (x86)\Internet Explorer\en-US\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSCOL11.PPD b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Uninstall Information\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\VideoLAN\VLC\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Microsoft Games\Purble Place\es-ES\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\release b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Adjacency.thmx b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Civic.thmx b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OSPP.VBS b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\DVD Maker\de-DE\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Java\jre7\lib\calendars.properties b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Microsoft Games\Hearts\de-DE\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Microsoft Games\Mahjong\es-ES\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd28.tlb b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Paper.thmx b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Installed_schemas14.xss b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\MSBuild\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Java\jre7\lib\net.properties b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Origin.thmx b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MML2OMML.XSL b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Mozilla Firefox\browser\features\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2564 vssvc.exe Token: SeRestorePrivilege 2564 vssvc.exe Token: SeAuditPrivilege 2564 vssvc.exe Token: SeIncreaseQuotaPrivilege 2844 WMIC.exe Token: SeSecurityPrivilege 2844 WMIC.exe Token: SeTakeOwnershipPrivilege 2844 WMIC.exe Token: SeLoadDriverPrivilege 2844 WMIC.exe Token: SeSystemProfilePrivilege 2844 WMIC.exe Token: SeSystemtimePrivilege 2844 WMIC.exe Token: SeProfSingleProcessPrivilege 2844 WMIC.exe Token: SeIncBasePriorityPrivilege 2844 WMIC.exe Token: SeCreatePagefilePrivilege 2844 WMIC.exe Token: SeBackupPrivilege 2844 WMIC.exe Token: SeRestorePrivilege 2844 WMIC.exe Token: SeShutdownPrivilege 2844 WMIC.exe Token: SeDebugPrivilege 2844 WMIC.exe Token: SeSystemEnvironmentPrivilege 2844 WMIC.exe Token: SeRemoteShutdownPrivilege 2844 WMIC.exe Token: SeUndockPrivilege 2844 WMIC.exe Token: SeManageVolumePrivilege 2844 WMIC.exe Token: 33 2844 WMIC.exe Token: 34 2844 WMIC.exe Token: 35 2844 WMIC.exe Token: SeIncreaseQuotaPrivilege 2844 WMIC.exe Token: SeSecurityPrivilege 2844 WMIC.exe Token: SeTakeOwnershipPrivilege 2844 WMIC.exe Token: SeLoadDriverPrivilege 2844 WMIC.exe Token: SeSystemProfilePrivilege 2844 WMIC.exe Token: SeSystemtimePrivilege 2844 WMIC.exe Token: SeProfSingleProcessPrivilege 2844 WMIC.exe Token: SeIncBasePriorityPrivilege 2844 WMIC.exe Token: SeCreatePagefilePrivilege 2844 WMIC.exe Token: SeBackupPrivilege 2844 WMIC.exe Token: SeRestorePrivilege 2844 WMIC.exe Token: SeShutdownPrivilege 2844 WMIC.exe Token: SeDebugPrivilege 2844 WMIC.exe Token: SeSystemEnvironmentPrivilege 2844 WMIC.exe Token: SeRemoteShutdownPrivilege 2844 WMIC.exe Token: SeUndockPrivilege 2844 WMIC.exe Token: SeManageVolumePrivilege 2844 WMIC.exe Token: 33 2844 WMIC.exe Token: 34 2844 WMIC.exe Token: 35 2844 WMIC.exe Token: SeIncreaseQuotaPrivilege 2232 WMIC.exe Token: SeSecurityPrivilege 2232 WMIC.exe Token: SeTakeOwnershipPrivilege 2232 WMIC.exe Token: SeLoadDriverPrivilege 2232 WMIC.exe Token: SeSystemProfilePrivilege 2232 WMIC.exe Token: SeSystemtimePrivilege 2232 WMIC.exe Token: SeProfSingleProcessPrivilege 2232 WMIC.exe Token: SeIncBasePriorityPrivilege 2232 WMIC.exe Token: SeCreatePagefilePrivilege 2232 WMIC.exe Token: SeBackupPrivilege 2232 WMIC.exe Token: SeRestorePrivilege 2232 WMIC.exe Token: SeShutdownPrivilege 2232 WMIC.exe Token: SeDebugPrivilege 2232 WMIC.exe Token: SeSystemEnvironmentPrivilege 2232 WMIC.exe Token: SeRemoteShutdownPrivilege 2232 WMIC.exe Token: SeUndockPrivilege 2232 WMIC.exe Token: SeManageVolumePrivilege 2232 WMIC.exe Token: 33 2232 WMIC.exe Token: 34 2232 WMIC.exe Token: 35 2232 WMIC.exe Token: SeIncreaseQuotaPrivilege 2232 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2900 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 32 PID 2824 wrote to memory of 2900 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 32 PID 2824 wrote to memory of 2900 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 32 PID 2824 wrote to memory of 2900 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 32 PID 2900 wrote to memory of 2844 2900 cmd.exe 34 PID 2900 wrote to memory of 2844 2900 cmd.exe 34 PID 2900 wrote to memory of 2844 2900 cmd.exe 34 PID 2824 wrote to memory of 2796 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 35 PID 2824 wrote to memory of 2796 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 35 PID 2824 wrote to memory of 2796 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 35 PID 2824 wrote to memory of 2796 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 35 PID 2796 wrote to memory of 2232 2796 cmd.exe 37 PID 2796 wrote to memory of 2232 2796 cmd.exe 37 PID 2796 wrote to memory of 2232 2796 cmd.exe 37 PID 2824 wrote to memory of 2120 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 38 PID 2824 wrote to memory of 2120 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 38 PID 2824 wrote to memory of 2120 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 38 PID 2824 wrote to memory of 2120 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 38 PID 2120 wrote to memory of 1016 2120 cmd.exe 40 PID 2120 wrote to memory of 1016 2120 cmd.exe 40 PID 2120 wrote to memory of 1016 2120 cmd.exe 40 PID 2824 wrote to memory of 2228 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 41 PID 2824 wrote to memory of 2228 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 41 PID 2824 wrote to memory of 2228 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 41 PID 2824 wrote to memory of 2228 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 41 PID 2228 wrote to memory of 2184 2228 cmd.exe 43 PID 2228 wrote to memory of 2184 2228 cmd.exe 43 PID 2228 wrote to memory of 2184 2228 cmd.exe 43 PID 2824 wrote to memory of 2464 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 44 PID 2824 wrote to memory of 2464 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 44 PID 2824 wrote to memory of 2464 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 44 PID 2824 wrote to memory of 2464 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 44 PID 2464 wrote to memory of 1380 2464 cmd.exe 46 PID 2464 wrote to memory of 1380 2464 cmd.exe 46 PID 2464 wrote to memory of 1380 2464 cmd.exe 46 PID 2824 wrote to memory of 3020 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 47 PID 2824 wrote to memory of 3020 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 47 PID 2824 wrote to memory of 3020 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 47 PID 2824 wrote to memory of 3020 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 47 PID 3020 wrote to memory of 1772 3020 cmd.exe 49 PID 3020 wrote to memory of 1772 3020 cmd.exe 49 PID 3020 wrote to memory of 1772 3020 cmd.exe 49 PID 2824 wrote to memory of 1744 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 50 PID 2824 wrote to memory of 1744 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 50 PID 2824 wrote to memory of 1744 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 50 PID 2824 wrote to memory of 1744 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 50 PID 1744 wrote to memory of 2556 1744 cmd.exe 52 PID 1744 wrote to memory of 2556 1744 cmd.exe 52 PID 1744 wrote to memory of 2556 1744 cmd.exe 52 PID 2824 wrote to memory of 1496 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 53 PID 2824 wrote to memory of 1496 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 53 PID 2824 wrote to memory of 1496 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 53 PID 2824 wrote to memory of 1496 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 53 PID 1496 wrote to memory of 1424 1496 cmd.exe 55 PID 1496 wrote to memory of 1424 1496 cmd.exe 55 PID 1496 wrote to memory of 1424 1496 cmd.exe 55 PID 2824 wrote to memory of 2908 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 56 PID 2824 wrote to memory of 2908 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 56 PID 2824 wrote to memory of 2908 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 56 PID 2824 wrote to memory of 2908 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 56 PID 2908 wrote to memory of 3024 2908 cmd.exe 58 PID 2908 wrote to memory of 3024 2908 cmd.exe 58 PID 2908 wrote to memory of 3024 2908 cmd.exe 58 PID 2824 wrote to memory of 944 2824 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 59 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe"C:\Users\Admin\AppData\Local\Temp\b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{096796F1-2149-464D-ACBB-03B5C167CC17}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{096796F1-2149-464D-ACBB-03B5C167CC17}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F892CD27-E23E-4515-87B3-8F8F21B9D9C9}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F892CD27-E23E-4515-87B3-8F8F21B9D9C9}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{32A7D592-2541-4316-9CBA-F77BBB019FC7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{32A7D592-2541-4316-9CBA-F77BBB019FC7}'" delete3⤵PID:1016
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4322938B-E7D8-427C-9899-D8612A7A139D}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4322938B-E7D8-427C-9899-D8612A7A139D}'" delete3⤵PID:2184
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{40688390-1826-4849-9E8B-083873315E70}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{40688390-1826-4849-9E8B-083873315E70}'" delete3⤵PID:1380
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D6A7C606-A48C-4CE7-8835-04E81D7912DF}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D6A7C606-A48C-4CE7-8835-04E81D7912DF}'" delete3⤵PID:1772
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B7D60577-15EA-4C7B-BE0B-C497017039D0}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B7D60577-15EA-4C7B-BE0B-C497017039D0}'" delete3⤵PID:2556
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BB1A373F-4301-4C27-8A7E-482A72564628}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BB1A373F-4301-4C27-8A7E-482A72564628}'" delete3⤵PID:1424
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E5A9288-DEC5-4D8F-9600-23F03936D215}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E5A9288-DEC5-4D8F-9600-23F03936D215}'" delete3⤵PID:3024
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{823E0A24-E393-468F-B11F-85124724B858}'" delete2⤵PID:944
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{823E0A24-E393-468F-B11F-85124724B858}'" delete3⤵PID:1056
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0A4CD207-FB7C-469F-9F7A-80D1BD4DFCFA}'" delete2⤵PID:2276
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0A4CD207-FB7C-469F-9F7A-80D1BD4DFCFA}'" delete3⤵PID:2180
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F64151A7-2488-4B24-9A4D-D03E41D3CAC7}'" delete2⤵PID:1320
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F64151A7-2488-4B24-9A4D-D03E41D3CAC7}'" delete3⤵PID:2076
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A40927C3-0F96-44E1-B89A-47B10F36A0E6}'" delete2⤵PID:2336
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A40927C3-0F96-44E1-B89A-47B10F36A0E6}'" delete3⤵PID:2264
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1C5B9C0E-6DDC-430F-9959-B1C7BC19DF79}'" delete2⤵PID:2504
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1C5B9C0E-6DDC-430F-9959-B1C7BC19DF79}'" delete3⤵PID:756
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0E322147-06DC-47C3-8F71-A37CFEE921A2}'" delete2⤵PID:2300
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0E322147-06DC-47C3-8F71-A37CFEE921A2}'" delete3⤵PID:1944
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A273B3E7-11AE-4B3C-8748-31324B458734}'" delete2⤵PID:2516
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A273B3E7-11AE-4B3C-8748-31324B458734}'" delete3⤵PID:2368
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{41A049F0-5D90-4970-A62C-95EBA2C69DB2}'" delete2⤵PID:1524
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{41A049F0-5D90-4970-A62C-95EBA2C69DB2}'" delete3⤵PID:1664
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8E1A70E3-B89F-4CF4-95D7-7FBA75E2544E}'" delete2⤵PID:1904
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8E1A70E3-B89F-4CF4-95D7-7FBA75E2544E}'" delete3⤵PID:1832
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5960d3a0f2b4f17e9220820060482dc
SHA184163d5b0ca469c80e7ca9f354be6a06b3fdf474
SHA25680992369c2e7fb7440f6a9fda3ba9fc6f06dc726f073d62eda61c8d27b50cf52
SHA512341f4221621e886b074d628c8d5a3614c1a855ef1533dc8869b17a0df155c33c7f75a09f394041e2e8c410a8786d4b01053454af756438040b86220fd6bfd74e