Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 10:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240221-en
windows7-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
29 signatures
150 seconds
General
-
Target
1.exe
-
Size
2.6MB
-
MD5
88d00427a014f1fdb88383a6a8ab97a5
-
SHA1
d8c5d3ab8e11aa9dd5236625b610837b5cbbfd27
-
SHA256
1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca
-
SHA512
764319cdf3423a0c38f9050694bd936f2081d1ae34580aa055171ac84ae4b77d488422a68a5e607d2df6ba2627835990fba93a8a405d29cd88c1cde828ce3531
-
SSDEEP
49152:wgwR0ifu1DBgutBPNw6m+sqFrDCcTeL7dzXVeH0Bl1nzBJ6GDaJP:wgwR0vguPPK6GkDC7hv1zeP
Malware Config
Signatures
-
Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral2/files/0x000700000002343d-37.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YOURDATA.exe -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 3432 bcdedit.exe 3156 bcdedit.exe -
Renames multiple (4520) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 4296 wbadmin.exe -
pid Process 5088 wbadmin.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangesa.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangesa.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangeadtopology.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iisadmin.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 1.exe -
Executes dropped EXE 10 IoCs
pid Process 1876 7za.exe 2588 7za.exe 3640 5koto.exe 700 YOURDATA.exe 4548 DC.exe 2060 YOURDATA.exe 2320 YOURDATA.exe 1040 YOURDATA.exe 4988 Everything.exe 3592 Everything.exe -
Loads dropped DLL 5 IoCs
pid Process 3640 5koto.exe 700 YOURDATA.exe 2320 YOURDATA.exe 2060 YOURDATA.exe 1040 YOURDATA.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" YOURDATA.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" YOURDATA.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile\shell\open\command 5koto.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile\shell\open 5koto.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command YOURDATA.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" 5koto.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile\shell\open\command YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 5koto.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 5koto.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile\shell 5koto.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YOURDATA = "\"C:\\Users\\Admin\\AppData\\Local\\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\\YOURDATA.exe\" " 5koto.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YOURDATA.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\R: Everything.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Java\jdk-1.8\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\[email protected] YOURDATA.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] YOURDATA.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\[email protected] YOURDATA.exe File opened for modification C:\Program Files\VideoLAN\VLC\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe -
pid Process 3240 powershell.exe 3052 powershell.exe 2296 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command YOURDATA.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\----Read-Me-----.txt\"" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Classes\.5000USD YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.5000USD\ = "mimicfile" YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 5koto.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile\shell\open\command 5koto.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile 5koto.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile\shell 5koto.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" 5koto.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" YOURDATA.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile\shell\open\command YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 5koto.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\exefile\shell\open 5koto.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2320 YOURDATA.exe 2320 YOURDATA.exe 1040 YOURDATA.exe 1040 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 700 YOURDATA.exe 3052 powershell.exe 3052 powershell.exe 3240 powershell.exe 3240 powershell.exe 2296 powershell.exe 2296 powershell.exe 3240 powershell.exe 2296 powershell.exe 3052 powershell.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe 2320 YOURDATA.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1876 7za.exe Token: 35 1876 7za.exe Token: SeRestorePrivilege 2588 7za.exe Token: 35 2588 7za.exe Token: SeSecurityPrivilege 2588 7za.exe Token: SeSecurityPrivilege 2588 7za.exe Token: SeIncreaseQuotaPrivilege 3640 5koto.exe Token: SeSecurityPrivilege 3640 5koto.exe Token: SeTakeOwnershipPrivilege 3640 5koto.exe Token: SeLoadDriverPrivilege 3640 5koto.exe Token: SeSystemProfilePrivilege 3640 5koto.exe Token: SeSystemtimePrivilege 3640 5koto.exe Token: SeProfSingleProcessPrivilege 3640 5koto.exe Token: SeIncBasePriorityPrivilege 3640 5koto.exe Token: SeCreatePagefilePrivilege 3640 5koto.exe Token: SeBackupPrivilege 3640 5koto.exe Token: SeRestorePrivilege 3640 5koto.exe Token: SeShutdownPrivilege 3640 5koto.exe Token: SeDebugPrivilege 3640 5koto.exe Token: SeSystemEnvironmentPrivilege 3640 5koto.exe Token: SeChangeNotifyPrivilege 3640 5koto.exe Token: SeRemoteShutdownPrivilege 3640 5koto.exe Token: SeUndockPrivilege 3640 5koto.exe Token: SeManageVolumePrivilege 3640 5koto.exe Token: SeImpersonatePrivilege 3640 5koto.exe Token: SeCreateGlobalPrivilege 3640 5koto.exe Token: 33 3640 5koto.exe Token: 34 3640 5koto.exe Token: 35 3640 5koto.exe Token: 36 3640 5koto.exe Token: SeIncreaseQuotaPrivilege 700 YOURDATA.exe Token: SeSecurityPrivilege 700 YOURDATA.exe Token: SeTakeOwnershipPrivilege 700 YOURDATA.exe Token: SeLoadDriverPrivilege 700 YOURDATA.exe Token: SeSystemProfilePrivilege 700 YOURDATA.exe Token: SeSystemtimePrivilege 700 YOURDATA.exe Token: SeProfSingleProcessPrivilege 700 YOURDATA.exe Token: SeIncBasePriorityPrivilege 700 YOURDATA.exe Token: SeCreatePagefilePrivilege 700 YOURDATA.exe Token: SeBackupPrivilege 700 YOURDATA.exe Token: SeRestorePrivilege 700 YOURDATA.exe Token: SeShutdownPrivilege 700 YOURDATA.exe Token: SeDebugPrivilege 700 YOURDATA.exe Token: SeSystemEnvironmentPrivilege 700 YOURDATA.exe Token: SeChangeNotifyPrivilege 700 YOURDATA.exe Token: SeRemoteShutdownPrivilege 700 YOURDATA.exe Token: SeUndockPrivilege 700 YOURDATA.exe Token: SeManageVolumePrivilege 700 YOURDATA.exe Token: SeImpersonatePrivilege 700 YOURDATA.exe Token: SeCreateGlobalPrivilege 700 YOURDATA.exe Token: 33 700 YOURDATA.exe Token: 34 700 YOURDATA.exe Token: 35 700 YOURDATA.exe Token: 36 700 YOURDATA.exe Token: SeIncreaseQuotaPrivilege 2320 YOURDATA.exe Token: SeIncreaseQuotaPrivilege 2060 YOURDATA.exe Token: SeSecurityPrivilege 2320 YOURDATA.exe Token: SeSecurityPrivilege 2060 YOURDATA.exe Token: SeTakeOwnershipPrivilege 2320 YOURDATA.exe Token: SeTakeOwnershipPrivilege 2060 YOURDATA.exe Token: SeLoadDriverPrivilege 2320 YOURDATA.exe Token: SeLoadDriverPrivilege 2060 YOURDATA.exe Token: SeSystemProfilePrivilege 2320 YOURDATA.exe Token: SeSystemProfilePrivilege 2060 YOURDATA.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4988 Everything.exe 3592 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1560 wrote to memory of 1876 1560 1.exe 83 PID 1560 wrote to memory of 1876 1560 1.exe 83 PID 1560 wrote to memory of 1876 1560 1.exe 83 PID 1560 wrote to memory of 2588 1560 1.exe 86 PID 1560 wrote to memory of 2588 1560 1.exe 86 PID 1560 wrote to memory of 2588 1560 1.exe 86 PID 1560 wrote to memory of 3640 1560 1.exe 90 PID 1560 wrote to memory of 3640 1560 1.exe 90 PID 1560 wrote to memory of 3640 1560 1.exe 90 PID 3640 wrote to memory of 700 3640 5koto.exe 91 PID 3640 wrote to memory of 700 3640 5koto.exe 91 PID 3640 wrote to memory of 700 3640 5koto.exe 91 PID 700 wrote to memory of 908 700 YOURDATA.exe 92 PID 700 wrote to memory of 908 700 YOURDATA.exe 92 PID 700 wrote to memory of 908 700 YOURDATA.exe 92 PID 908 wrote to memory of 4548 908 cmd.exe 94 PID 908 wrote to memory of 4548 908 cmd.exe 94 PID 908 wrote to memory of 4548 908 cmd.exe 94 PID 700 wrote to memory of 2060 700 YOURDATA.exe 97 PID 700 wrote to memory of 2060 700 YOURDATA.exe 97 PID 700 wrote to memory of 2060 700 YOURDATA.exe 97 PID 700 wrote to memory of 2320 700 YOURDATA.exe 98 PID 700 wrote to memory of 2320 700 YOURDATA.exe 98 PID 700 wrote to memory of 2320 700 YOURDATA.exe 98 PID 700 wrote to memory of 1040 700 YOURDATA.exe 99 PID 700 wrote to memory of 1040 700 YOURDATA.exe 99 PID 700 wrote to memory of 1040 700 YOURDATA.exe 99 PID 700 wrote to memory of 4988 700 YOURDATA.exe 106 PID 700 wrote to memory of 4988 700 YOURDATA.exe 106 PID 700 wrote to memory of 4988 700 YOURDATA.exe 106 PID 1560 wrote to memory of 5032 1560 1.exe 109 PID 1560 wrote to memory of 5032 1560 1.exe 109 PID 1560 wrote to memory of 5032 1560 1.exe 109 PID 700 wrote to memory of 3248 700 YOURDATA.exe 125 PID 700 wrote to memory of 3248 700 YOURDATA.exe 125 PID 700 wrote to memory of 876 700 YOURDATA.exe 126 PID 700 wrote to memory of 876 700 YOURDATA.exe 126 PID 700 wrote to memory of 5000 700 YOURDATA.exe 128 PID 700 wrote to memory of 5000 700 YOURDATA.exe 128 PID 700 wrote to memory of 2188 700 YOURDATA.exe 130 PID 700 wrote to memory of 2188 700 YOURDATA.exe 130 PID 700 wrote to memory of 1216 700 YOURDATA.exe 132 PID 700 wrote to memory of 1216 700 YOURDATA.exe 132 PID 700 wrote to memory of 2968 700 YOURDATA.exe 133 PID 700 wrote to memory of 2968 700 YOURDATA.exe 133 PID 700 wrote to memory of 2684 700 YOURDATA.exe 134 PID 700 wrote to memory of 2684 700 YOURDATA.exe 134 PID 700 wrote to memory of 1320 700 YOURDATA.exe 135 PID 700 wrote to memory of 1320 700 YOURDATA.exe 135 PID 700 wrote to memory of 3828 700 YOURDATA.exe 136 PID 700 wrote to memory of 3828 700 YOURDATA.exe 136 PID 700 wrote to memory of 2028 700 YOURDATA.exe 137 PID 700 wrote to memory of 2028 700 YOURDATA.exe 137 PID 700 wrote to memory of 1132 700 YOURDATA.exe 138 PID 700 wrote to memory of 1132 700 YOURDATA.exe 138 PID 700 wrote to memory of 1092 700 YOURDATA.exe 139 PID 700 wrote to memory of 1092 700 YOURDATA.exe 139 PID 700 wrote to memory of 1768 700 YOURDATA.exe 140 PID 700 wrote to memory of 1768 700 YOURDATA.exe 140 PID 700 wrote to memory of 1684 700 YOURDATA.exe 141 PID 700 wrote to memory of 1684 700 YOURDATA.exe 141 PID 700 wrote to memory of 872 700 YOURDATA.exe 143 PID 700 wrote to memory of 872 700 YOURDATA.exe 143 PID 700 wrote to memory of 2296 700 YOURDATA.exe 146 -
System policy modification 1 TTPs 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" YOURDATA.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p5056156942493511584 Everything64.dll2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\5koto.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\5koto.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"3⤵
- UAC bypass
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:700 -
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D4⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\DC.exeDC.exe /D5⤵
- Executes dropped EXE
PID:4548
-
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e watch -pid 700 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1040
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:4988
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off4⤵PID:3248
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:876
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:5000
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2188
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:1216
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2968
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2684
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:1320
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:3828
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2028
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:1132
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:1092
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:1768
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵PID:1684
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵PID:872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2296
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3052
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3240
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:3432
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:3156
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4296
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:5088
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:3592
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵PID:5032
-
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5060
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2468
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2740
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3536
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1356
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3208
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4160
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4456
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3648
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2776
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3796
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3220
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3316
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:5060
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:868
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:2452
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cae124bd44f5de434c311f1aeac657ef
SHA1d96555e009b25d3c50795210aba7fa6e6e7718d5
SHA256896198ae9653d98eb2b01fa822bb244188fc1e2f9b7be65020791966a0967287
SHA51295566b671f1d542b39f7d7e1e4a5b27b289c79ec88408fd0e40648c8bdfe19ea64aeb850a6558adfb26c90aa72c502ed64bb7c18d7f73911f421c2faa0ba0472
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
1KB
MD5fb5eb8486decd5ee26d4a7216c2bab97
SHA17cb5457255f1b5135b3a16a93e81f97d40803615
SHA25688cb58071acf3f407762095429b8ebc25868b9826c29785981585c24ce2cd6e5
SHA51275e7b968ee81f10844ddd24cc446fe276979cbb6588dacee72f57dd9196abcd822745b6e4d95a7cf45650fb73b73e2ee03576b3d6cf4744a1eb6882b956dc714
-
Filesize
174B
MD52c4e5549e3cbece5a449986ff5503211
SHA12489537b3afc0218e6ac4ae9c38001bc5847ad65
SHA256a496df7140670dc7eb643762486405a29e00bcb1bb470049109562da701ef70e
SHA512ef55de3b65f6b41833a1c7d9d3bd0e90154029d6a9e921fb84de4df5670be40b87362e35187aa2a34f6e07fdc7bc34839c0ea5e1bea1754e4c1e069def894d6a
-
Filesize
2.3MB
MD568d90c681c9748e8489f3f9fc622301d
SHA1931ebcaec96692ba2054379a489a4af0451bf630
SHA256cfbcf827900a5dc36d1d2ba4b4879ce703a429b1952e6e9616f498a9bde68c91
SHA5124dcd84246dec0522787dff8fb1ff90e418e1ed47496f9e35e56e5c5c26dcc8a2283a0478bcbd44d61a763ea46b050675aca1d93a6ff628d39f7f51e254fbdd80
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
-
Filesize
802KB
MD5ac34ba84a5054cd701efad5dd14645c9
SHA1dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
SHA256c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
SHA512df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
548B
MD5742c2400f2de964d0cce4a8dabadd708
SHA1c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA2562fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
SHA51263a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
1.7MB
MD51538b51a67fde66f3b41b5ac47f4ac1b
SHA1296956729df307b32e8fd9fd4388e6f2dbfb5298
SHA2560053300049b43fe839eb1c630b42157f5dd7dfddb49e9ee77a5ce317f925727a
SHA5129f6507d23f7c2be73fc3b43de3e90fb80c76d0aae618deb73658e8c225357e9d9a2d54111e306f3d9caed177a0a8e8c5c162c91cdef3502c45e050c168c5c8f5
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
13.2MB
MD50c15480a7b8590c6a6f917589786aae0
SHA1e3b0bc1a1cb8f513a79b265f48d295692613408c
SHA256142b44f4fd5665b033982ea4e4a9ee30e6c0cf4ce4e86bc64e801151d5c1c8ca
SHA512ea3f22a1c163a16781a3f4e58291067be469282d9ba4bf60d757f5e410465aa0a56dcd8e0d802f3d15c38c35c33aac994531b5d1c1f6cd20e2a6df6ad5e65f95
-
Filesize
20KB
MD5760a0109e4cf47d405b18968830071d8
SHA132e2c1079af2382bfb6aaaffd405f5fd138e0d20
SHA256f3e4ab5689d6dcdba858c480cc79358663b49e7c809b3b98ec3b609ab99440aa
SHA5121d662e9b4e7cba1c95c4fbcbd9489dd06daf87316b3a181489990a10d130ad6712696354a7887d538af139d3d3e0a995f81370bd40777c482e735a77f53335ed
-
Filesize
32B
MD5cb3183846b0acf1af3710e1708ebb5a2
SHA1af3686662ac28bf1d693f69aa14413a77400d6e7
SHA256a935f43e146fce4a603b20d8394e5a335ef8e4121332206ab4e7e14d17caca44
SHA512a17a6bec044d295a692e9ad19455b3ff055076e81f3c3fd555d6dbb929f3dd406a429bce0ba059628ee1a50e05f2538754a5271bc84a5e04f38b991d44787f82
-
Filesize
34KB
MD51c20deb9e4dd2456765f3ebb1416d07b
SHA1846fbcbc32cd7e0b2bdfff1f870cae51c6369799
SHA2562bba81a3c54a1f3a77b70fbe83a6032fbad2f3bf5bb2560fbabaaaf0dcef1a69
SHA51217a51ee6f71c7ca36264a9cefc4fefc27427590ca1cc19551698bbc9b4c973fd7cdee6184cebdcaf5d3319347e808813d09f361701a241aa01f32b9603f1bbd3
-
Filesize
33KB
MD55f3eb7df034b72af82d0249cf3ecd00b
SHA10746044c32c6204937c3bd9801271ae931d2dfc1
SHA256ce3e78847e0abcbe537a0b35e31fc7408d599ac5dda7c28968db7626384e8dcf
SHA5126c1d9fbb55113e95dd3b2817a12a1e7a1da53f4f4fae41902eb4d487745ccf1b7972e2e82f4e5f3a5b904fa910cc86e0b824e5cc2b9070182efd02d29f7028d8