Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
7244224914ec43925ee9d7281e863cdb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7244224914ec43925ee9d7281e863cdb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
setup_installer.exe
Resource
win7-20231215-en
General
-
Target
setup_installer.exe
-
Size
5.2MB
-
MD5
52185d08fdcc8452577760cba1a8c9bf
-
SHA1
4865c1c006cb8647463093a5a99953a4dfc2f4d4
-
SHA256
04328f6c08f6c49f2e32b80285e1fb2c9c4849b53bbfd09b815c643b46f33f78
-
SHA512
37d8b9f699a630413716570770204bfc4699441d40e2caf376182d713a429078310555b04429bfaccc7906ade9332c3a704111e5597cd94a2ea85acafded55df
-
SSDEEP
98304:xfCvLUBsgPc9Owr3MRJV1057hNd0aGLHcwUc81ejgKaLrOtlgTZN0oK/zEQC:xsLUCgPEMRJVQFga4HcwUcEKtlVDLlC
Malware Config
Extracted
privateloader
http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
http://wfsdragon.ru/api/setStats.php
37.0.10.237
Extracted
redline
pub1
viacetequn.site:80
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Extracted
smokeloader
pub5
Signatures
-
CryptBot payload 4 IoCs
resource yara_rule behavioral3/memory/2308-345-0x0000000004BB0000-0x0000000004C53000-memory.dmp family_cryptbot behavioral3/memory/2308-347-0x0000000004BB0000-0x0000000004C53000-memory.dmp family_cryptbot behavioral3/memory/2308-346-0x0000000004BB0000-0x0000000004C53000-memory.dmp family_cryptbot behavioral3/memory/2308-348-0x0000000004BB0000-0x0000000004C53000-memory.dmp family_cryptbot -
Detect Fabookie payload 1 IoCs
resource yara_rule behavioral3/files/0x0006000000018b4d-74.dat family_fabookie -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral3/memory/1192-131-0x0000000000330000-0x0000000000352000-memory.dmp family_redline behavioral3/memory/1192-140-0x0000000002E60000-0x0000000002E80000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
resource yara_rule behavioral3/memory/1192-131-0x0000000000330000-0x0000000000352000-memory.dmp family_sectoprat behavioral3/memory/1192-140-0x0000000002E60000-0x0000000002E80000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
resource yara_rule behavioral3/files/0x0034000000015c63-45.dat aspack_v212_v242 behavioral3/files/0x000d0000000122e4-47.dat aspack_v212_v242 behavioral3/files/0x000a000000015e82-52.dat aspack_v212_v242 -
Executes dropped EXE 13 IoCs
pid Process 1800 setup_install.exe 1576 Mon0073407dbaf4.exe 2856 Mon00dd025149a8874.exe 948 Mon0073407dbaf4.exe 2840 Mon0064e6d9c4e87002f.exe 2896 Mon0079fda2128f31.exe 2892 Mon003cfa9b5e9a3a.exe 1192 Mon00c04b224b6030608.exe 1804 Mon0026809d87f.exe 1124 Mon00cb8e95f116ee.exe 1188 Mon001c934f566cfee3.exe 2212 Amica.exe.com 2308 Amica.exe.com -
Loads dropped DLL 49 IoCs
pid Process 2360 setup_installer.exe 2360 setup_installer.exe 2360 setup_installer.exe 1800 setup_install.exe 1800 setup_install.exe 1800 setup_install.exe 1800 setup_install.exe 1800 setup_install.exe 1800 setup_install.exe 1800 setup_install.exe 1800 setup_install.exe 3056 cmd.exe 3056 cmd.exe 1576 Mon0073407dbaf4.exe 1576 Mon0073407dbaf4.exe 1100 cmd.exe 652 cmd.exe 1168 cmd.exe 652 cmd.exe 1576 Mon0073407dbaf4.exe 2516 cmd.exe 1396 cmd.exe 1396 cmd.exe 2036 cmd.exe 2036 cmd.exe 1192 Mon00c04b224b6030608.exe 1192 Mon00c04b224b6030608.exe 2856 Mon00dd025149a8874.exe 2856 Mon00dd025149a8874.exe 1772 cmd.exe 1804 Mon0026809d87f.exe 1804 Mon0026809d87f.exe 1124 Mon00cb8e95f116ee.exe 1124 Mon00cb8e95f116ee.exe 1376 cmd.exe 1188 Mon001c934f566cfee3.exe 1188 Mon001c934f566cfee3.exe 948 Mon0073407dbaf4.exe 948 Mon0073407dbaf4.exe 1460 cmd.exe 2212 Amica.exe.com 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Mon001c934f566cfee3.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 26 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2196 1800 WerFault.exe 28 772 1804 WerFault.exe 49 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon00dd025149a8874.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon00dd025149a8874.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon00dd025149a8874.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Amica.exe.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Amica.exe.com -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Mon0064e6d9c4e87002f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Mon0064e6d9c4e87002f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Mon0064e6d9c4e87002f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Mon003cfa9b5e9a3a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Mon003cfa9b5e9a3a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Mon003cfa9b5e9a3a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Mon003cfa9b5e9a3a.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2376 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2856 Mon00dd025149a8874.exe 2856 Mon00dd025149a8874.exe 1868 powershell.exe 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2856 Mon00dd025149a8874.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2840 Mon0064e6d9c4e87002f.exe Token: SeDebugPrivilege 2892 Mon003cfa9b5e9a3a.exe Token: SeDebugPrivilege 1868 powershell.exe Token: SeDebugPrivilege 1192 Mon00c04b224b6030608.exe Token: SeShutdownPrivilege 1196 Process not Found -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2212 Amica.exe.com 2212 Amica.exe.com 2212 Amica.exe.com 2308 Amica.exe.com 2308 Amica.exe.com 2308 Amica.exe.com 2308 Amica.exe.com 2308 Amica.exe.com -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 2212 Amica.exe.com 2212 Amica.exe.com 2212 Amica.exe.com 2308 Amica.exe.com 2308 Amica.exe.com 2308 Amica.exe.com -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1800 2360 setup_installer.exe 28 PID 2360 wrote to memory of 1800 2360 setup_installer.exe 28 PID 2360 wrote to memory of 1800 2360 setup_installer.exe 28 PID 2360 wrote to memory of 1800 2360 setup_installer.exe 28 PID 2360 wrote to memory of 1800 2360 setup_installer.exe 28 PID 2360 wrote to memory of 1800 2360 setup_installer.exe 28 PID 2360 wrote to memory of 1800 2360 setup_installer.exe 28 PID 1800 wrote to memory of 2440 1800 setup_install.exe 30 PID 1800 wrote to memory of 2440 1800 setup_install.exe 30 PID 1800 wrote to memory of 2440 1800 setup_install.exe 30 PID 1800 wrote to memory of 2440 1800 setup_install.exe 30 PID 1800 wrote to memory of 2440 1800 setup_install.exe 30 PID 1800 wrote to memory of 2440 1800 setup_install.exe 30 PID 1800 wrote to memory of 2440 1800 setup_install.exe 30 PID 1800 wrote to memory of 3056 1800 setup_install.exe 31 PID 1800 wrote to memory of 3056 1800 setup_install.exe 31 PID 1800 wrote to memory of 3056 1800 setup_install.exe 31 PID 1800 wrote to memory of 3056 1800 setup_install.exe 31 PID 1800 wrote to memory of 3056 1800 setup_install.exe 31 PID 1800 wrote to memory of 3056 1800 setup_install.exe 31 PID 1800 wrote to memory of 3056 1800 setup_install.exe 31 PID 1800 wrote to memory of 652 1800 setup_install.exe 32 PID 1800 wrote to memory of 652 1800 setup_install.exe 32 PID 1800 wrote to memory of 652 1800 setup_install.exe 32 PID 1800 wrote to memory of 652 1800 setup_install.exe 32 PID 1800 wrote to memory of 652 1800 setup_install.exe 32 PID 1800 wrote to memory of 652 1800 setup_install.exe 32 PID 1800 wrote to memory of 652 1800 setup_install.exe 32 PID 1800 wrote to memory of 2516 1800 setup_install.exe 38 PID 1800 wrote to memory of 2516 1800 setup_install.exe 38 PID 1800 wrote to memory of 2516 1800 setup_install.exe 38 PID 1800 wrote to memory of 2516 1800 setup_install.exe 38 PID 1800 wrote to memory of 2516 1800 setup_install.exe 38 PID 1800 wrote to memory of 2516 1800 setup_install.exe 38 PID 1800 wrote to memory of 2516 1800 setup_install.exe 38 PID 1800 wrote to memory of 2036 1800 setup_install.exe 37 PID 1800 wrote to memory of 2036 1800 setup_install.exe 37 PID 1800 wrote to memory of 2036 1800 setup_install.exe 37 PID 1800 wrote to memory of 2036 1800 setup_install.exe 37 PID 1800 wrote to memory of 2036 1800 setup_install.exe 37 PID 1800 wrote to memory of 2036 1800 setup_install.exe 37 PID 1800 wrote to memory of 2036 1800 setup_install.exe 37 PID 1800 wrote to memory of 1396 1800 setup_install.exe 36 PID 1800 wrote to memory of 1396 1800 setup_install.exe 36 PID 1800 wrote to memory of 1396 1800 setup_install.exe 36 PID 1800 wrote to memory of 1396 1800 setup_install.exe 36 PID 1800 wrote to memory of 1396 1800 setup_install.exe 36 PID 1800 wrote to memory of 1396 1800 setup_install.exe 36 PID 1800 wrote to memory of 1396 1800 setup_install.exe 36 PID 1800 wrote to memory of 1772 1800 setup_install.exe 35 PID 1800 wrote to memory of 1772 1800 setup_install.exe 35 PID 1800 wrote to memory of 1772 1800 setup_install.exe 35 PID 1800 wrote to memory of 1772 1800 setup_install.exe 35 PID 1800 wrote to memory of 1772 1800 setup_install.exe 35 PID 1800 wrote to memory of 1772 1800 setup_install.exe 35 PID 1800 wrote to memory of 1772 1800 setup_install.exe 35 PID 1800 wrote to memory of 1168 1800 setup_install.exe 34 PID 1800 wrote to memory of 1168 1800 setup_install.exe 34 PID 1800 wrote to memory of 1168 1800 setup_install.exe 34 PID 1800 wrote to memory of 1168 1800 setup_install.exe 34 PID 1800 wrote to memory of 1168 1800 setup_install.exe 34 PID 1800 wrote to memory of 1168 1800 setup_install.exe 34 PID 1800 wrote to memory of 1168 1800 setup_install.exe 34 PID 1800 wrote to memory of 1376 1800 setup_install.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\7zS839A1056\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS839A1056\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵PID:2440
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon0073407dbaf4.exe3⤵
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\7zS839A1056\Mon0073407dbaf4.exeMon0073407dbaf4.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\7zS839A1056\Mon0073407dbaf4.exe"C:\Users\Admin\AppData\Local\Temp\7zS839A1056\Mon0073407dbaf4.exe" -a5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon00dd025149a8874.exe3⤵
- Loads dropped DLL
PID:652 -
C:\Users\Admin\AppData\Local\Temp\7zS839A1056\Mon00dd025149a8874.exeMon00dd025149a8874.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2856
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon001c934f566cfee3.exe3⤵
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\7zS839A1056\Mon001c934f566cfee3.exeMon001c934f566cfee3.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1188 -
C:\Windows\SysWOW64\dllhost.exedllhost.exe5⤵PID:2116
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Sfaldavano.xls5⤵PID:1048
-
C:\Windows\SysWOW64\cmd.execmd6⤵
- Loads dropped DLL
PID:1460 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^fARmmICHAETEVIAiewsqLILJhRoBwBFrurUNyycHHdHtUkLfezrMoLJHPojHmwGYYPnRONeXFJaxqGOwySnHnTVxzjYWSOiGKIutNTBfsuin$" Serravano.xls7⤵PID:1724
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Amica.exe.comAmica.exe.com Y7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Amica.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Amica.exe.com Y8⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2308
-
-
-
C:\Windows\SysWOW64\PING.EXEping QVMRJQQO -n 307⤵
- Runs ping.exe
PID:2376
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon003cfa9b5e9a3a.exe3⤵
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\7zS839A1056\Mon003cfa9b5e9a3a.exeMon003cfa9b5e9a3a.exe4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon00cb8e95f116ee.exe3⤵
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\7zS839A1056\Mon00cb8e95f116ee.exeMon00cb8e95f116ee.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon00c04b224b6030608.exe3⤵
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\7zS839A1056\Mon00c04b224b6030608.exeMon00c04b224b6030608.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon0026809d87f.exe3⤵
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\7zS839A1056\Mon0026809d87f.exeMon0026809d87f.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 9725⤵
- Loads dropped DLL
- Program crash
PID:772
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon0079fda2128f31.exe3⤵
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\7zS839A1056\Mon0079fda2128f31.exeMon0079fda2128f31.exe4⤵
- Executes dropped EXE
PID:2896
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon0064e6d9c4e87002f.exe3⤵
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\7zS839A1056\Mon0064e6d9c4e87002f.exeMon0064e6d9c4e87002f.exe4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 4363⤵
- Loads dropped DLL
- Program crash
PID:2196
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD55f0617b7287c5f217e89b9407284736e
SHA164db3f9ceedda486648db13b4ed87e868c9192ca
SHA256b0560993c8b7df45ede6031471dee138a335c428dd16454570ffa1b66175aa2a
SHA5126367d9f5749260b326328f2ca455cbb22fc4696f44e61fab7616e39471742afbce26b69ed3ffb27f4d9cad7b643a50b54aea5f33892f0422d331ca76b6ea05b9
-
Filesize
572KB
MD56dba60503ea60560826fe5a12dced3e9
SHA17bb04d508e970701dc2945ed42fe96dbb083ec33
SHA2568d49f82aaa8eb3dfa5c7d7dffd7efb9dd6b776ef08b8b8c5afc6cb8ab0743865
SHA512837c0f0dc70386ce1d143332e4d273750f64dd7f8be5b4ce79aa39628ceebf27d01e447ed0b9ec6064c6ba9dbaa13a64631c2e136ec99d27c0f4a25681053ff9
-
Filesize
156KB
MD5cda12ae37191467d0a7d151664ed74aa
SHA12625b2e142c848092aa4a51584143ab7ed7d33d2
SHA2561e07bb767e9979d4afa4f8d69b68e33dd7c1a43f6863096a2b091047a10cdc2e
SHA51277c4429e22754e50828d9ec344cd63780acd31c350ef16ef69e2a396114df10e7c43d791440faee90e7f80be73e845ab579fd7b38efbd12f5de11bbc906f1c1d
-
Filesize
8KB
MD5408f2c9252ad66429a8d5401f1833db3
SHA13829d2d03a728ecd59b38cc189525220a60c05db
SHA256890db580fac738971bc7c714735ff6f1f2ee31edccd7881044da3e98452af664
SHA512d4c89dfd928023b9f4380808b27e032342d2a85963b95bbed3191cc03b455dbc6f5ffecf29828a53b1d9011b3881f1cda9d15d269a2cbcbd4be5c993bcd9643b
-
Filesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
Filesize
1.3MB
MD557d883f2e96dccb2ca2867cb858151f8
SHA109e0fcd15cc69bcd6a9ef2928c4054d754b1aaa3
SHA256c1dc7829e850ff7189e993b6f2bd3b00d56f3ec062da364e8698fd39e79f0072
SHA5122235866e39dccc8cd524592f6f0b514878bf0c5ad13ee95bd01508766eb789528394bf329faee481d81e3fe389664fb5673d214d478cda58f4293bfe58ba4012
-
Filesize
248KB
MD5d23c06e25b4bd295e821274472263572
SHA19ad295ec3853dc465ae77f9479f8c4f76e2748b8
SHA256f02c1351a8b3dc296cf815bb4cd2bcc2d25b3b9a258ab2ad95e8be3d9602322c
SHA512122b0ef44682f83651d81df622bbff5ad9fa0f5bbd6b925e35add9568825c0316c0f9921dac21cf92cb44658fc854f7829c01ae3b84aa0745929f8ef5e6ae1ae
-
Filesize
1.5MB
MD5df80b76857b74ae1b2ada8efb2a730ee
SHA15653be57533c6eb058fed4963a25a676488ef832
SHA2565545c43eb14b0519ab997673efa379343f98d2b6b1578d9fdeb369234789f9dd
SHA512060b04536003ce4a91e5847d487701eed7e093408e427198be552f0af37aee498929586f3a0110c78173873a28d95c6c0a4cdd01c7218274f5849a4730f9efdd
-
Filesize
236KB
MD57de877618ab2337aa32901030365b2ff
SHA1adb006662ec67e244d2d9c935460c656c3d47435
SHA256989079a8616a9e5c4f77c0e86b89d170dc7b8c4bf23768111f8e0d60e2c29da7
SHA512b7f9b402baad41e8e9df1db856b2273b64dd603b6c5bae147979fbff215af79b1d261cdd89f0eb050c7ef3db820bb0207decd58fbc7f9a8d4ffb179133a7c8ff
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
2.1MB
MD50062696453056d114ad5a5c392c6b05c
SHA140e8a58d4f0c75fd1840cb44cb45aa7068a21d73
SHA2568d35902fd4f9662d6582dcfc96c8235fd94160620b414ad803cd7a7d7d5a1766
SHA51235e210211db9c9725a3adc89e211960287d01f3fb3d959a2b49dde3fcd85f8d4f25e6dd4ac78135bd46edf4722c40d41169f39b0548d2fc54c3a32c019a7be26
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
44KB
MD5498aeeea500749c11b74ece6fcc5d505
SHA14dc3d7db071368e128be1a6c2d3f5d79ab83cc9d
SHA2567835888b0fb3279b4fc8c4ddf8e4724f858e47fe175ff983992dca526f62a1f9
SHA512abca2fc5f6ce52730a607d620c02558afcf273162be33491a3f09c6d52d1638e4134f4386dd6dfe9476956750c1d8b29f940dc6d1985fbbe2dba1cf422b2f353
-
Filesize
8KB
MD54499f3696235ebad8a1833b10fe0f3e0
SHA1158c9bc982981058fc5e951012c7ecf707f66578
SHA25675ee0c753a8d6b5151216f6f717784e9a1cdb6dda1e65208b607a2e6a5890198
SHA512aa0ff124f1e18b7c616edc2184bed67fe129b426c1c923f479f01435150b383fe2ddfa7fef68f30d627635411ee0ab6be57b3640deeaeecb33ff081739aeea91
-
Filesize
52KB
MD54ae17bf1ebd4d649d09809b7c3664764
SHA1d96cde6d16f42781ed66fa0e578ff966eec0a975
SHA2568f7a6dc14f3fd0c58b5bc2690b8395468fb20295ee6d9f92a8071b4afb5680e0
SHA512eba8424765cde0607070483ac7516148d37da3797eba221c1491b934237c0ba1a22818dab1e9f6380fb4b95f6fbff7fb64ff4ecdef56ed53b689b98fc1754818
-
Filesize
8KB
MD5d6011272afe8311aa501697e2dd29e5d
SHA1d643e4de7abceb50c8ed0eef3f6ed878f1a95255
SHA256b538bd426a7a3005f5d7be0eca98136fe1275070ac63a85d8e5ec4836df4596a
SHA5121e73e0cc86adb53e8f568d0767ee741a48c601358f085179ba8b60bb78e954ced6cdca45790fa1787ffe994e4370c77fd6f80683fdbe09a858fcce22797ab2b1
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06