Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
02/08/2024, 15:39
240802-s3t49svclf 802/08/2024, 15:32
240802-syqlaazcmn 602/08/2024, 15:28
240802-swdhyavalh 802/08/2024, 15:24
240802-ss9rzathna 8Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 15:24
Static task
static1
Behavioral task
behavioral1
Sample
AndroidSideloader.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
AndroidSideloader.exe
Resource
win10v2004-20240802-en
General
-
Target
AndroidSideloader.exe
-
Size
4.1MB
-
MD5
b7fa8a83dd1c92d93679c58d06691369
-
SHA1
0cff7bb71ff43ee92172f30566d8ee1b043129fc
-
SHA256
6cf2bcdb1a463fc69eddb125eba8cc12854ee23effcd7c65b968667c668a7f0b
-
SHA512
d74f8450f1fda260d0176ceba347bde6ad58b24a09eaac3cc921e20236a11707cab2f5eaee3bb10907c387d67efbcb66d823ae052b1317f3e953c4984a2b94b8
-
SSDEEP
24576:JUjV//Ppn/JcDJ7bdukqjVnlqud+/2P+AXg:S5//Rn/QJ7bYkqXfd+/9AQ
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation AndroidSideloader.exe -
Executes dropped EXE 21 IoCs
pid Process 2696 7z.exe 4716 7z.exe 1400 adb.exe 4748 adb.exe 4516 adb.exe 4724 rclone.exe 3452 rclone.exe 640 7z.exe 1536 adb.exe 2232 adb.exe 4000 adb.exe 60 adb.exe 4768 adb.exe 3532 adb.exe 1944 adb.exe 4472 adb.exe 2916 adb.exe 1912 adb.exe 2492 adb.exe 2136 adb.exe 3684 adb.exe -
Loads dropped DLL 32 IoCs
pid Process 1400 adb.exe 1400 adb.exe 4748 adb.exe 4748 adb.exe 4516 adb.exe 4516 adb.exe 1536 adb.exe 1536 adb.exe 2232 adb.exe 2232 adb.exe 4000 adb.exe 4000 adb.exe 60 adb.exe 60 adb.exe 4768 adb.exe 4768 adb.exe 3532 adb.exe 3532 adb.exe 1944 adb.exe 1944 adb.exe 4472 adb.exe 4472 adb.exe 2916 adb.exe 2916 adb.exe 1912 adb.exe 1912 adb.exe 2492 adb.exe 2492 adb.exe 2136 adb.exe 2136 adb.exe 3684 adb.exe 3684 adb.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 5 raw.githubusercontent.com 15 raw.githubusercontent.com 4 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AndroidSideloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AndroidSideloader.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e AndroidSideloader.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7F95276D4951499FD756DF344AA24FB38CEAF678 AndroidSideloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7F95276D4951499FD756DF344AA24FB38CEAF678\Blob = 0300000001000000140000007f95276d4951499fd756df344aa24fb38ceaf6781400000001000000140000000f6be64bce3947aef67e901e79f0309192c85fa3040000000100000010000000ee39380f325cf0c51f4c6f7be0a4c8990f000000010000003000000011634607adf75b5e2bb0c3f38525f19b8cb00415cf48940a83e1da5b90dbf3d251de3a2659675838654f1705ba8fe7411900000001000000100000007818fd06fa225d60f1172f1ef2efcebf5c00000001000000040000008001000018000000010000001000000076935b5c5a037216daaf8aac76df42c1200000000100000089030000308203853082030ca003020102021023b76de3c1bb2b1a51961e08eab764e8300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3230303133303030303030305a170d3330303132393233353935395a304b310b30090603550406130241543110300e060355040a13075a65726f53534c312a3028060355040313215a65726f53534c2045434320446f6d61696e2053656375726520536974652043413076301006072a8648ce3d020106052b8104002203620004364161172b5325edaaca94e4d6da4857ef50ba846482d7bb051bd61f0624f6a5339d8ce7f10b5568638230105f8d65ecaaa8af97cab586ce30018974dee34e5e016eee267bcc53fa23a4f7441d3e4d1e5f66a6ad85f6f2e3bc8e099880248e20a382017530820171301f0603551d230418301680143ae10986d4cf19c29676744976dce035c663639a301d0603551d0e041604140f6be64bce3947aef67e901e79f0309192c85fa3300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b0601050507030230220603551d20041b3019300d060b2b06010401b2310102024e3008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737445434343657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374454343416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300a06082a8648ce3d040303036700306402302470540f01c940ddc854d96d54cac808ca984374d83ff4d7a95f6df261b9700a261b6330a88b319cbf77ec67b07fa588023025adaba4b0ee8d52e0dd0d7c9ddf7d1daee25c649c74f87e63e5c14e601686b0a75e196eec08c691d8fb0314a1a595ab AndroidSideloader.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\CA7788C32DA1E4B7863A4FB57D00B55DDACBC7F9 AndroidSideloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\CA7788C32DA1E4B7863A4FB57D00B55DDACBC7F9\Blob = 030000000100000014000000ca7788c32da1e4b7863a4fb57d00b55ddacbc7f91400000001000000140000003ae10986d4cf19c29676744976dce035c663639a04000000010000001000000042f8529fe545103fdd848980a8647f290f0000000100000030000000ed080184c5a30d366162d70be6fbb98ed70ace8650c3b7bccc7687cddaffb50f7d12eea1a961cc6f7fd0da9b3422f9fa19000000010000001000000076935b5c5a037216daaf8aac76df42c15c0000000100000004000000800100001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000d7030000308203d3308202bba003020102021056671d04ea4f994c6f10814759d27594300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c0500038201010019eceb9d892c200b04801d18de429972991632bd0e9c755b2c15e229406deeff72dbdbab901f8c95f28a3d087242895007e239156c0187d9161af5c0752bc5e6561107dfd898bc7c9f1939df8bca006473bc46109b93238dbe16c32e08829c863374763b284c8d034285b3e2b22342d51f7a756a1ad17caa6721c4333a396d53c9a2ed6222a8bbe2556c996c436b9197d10c0b93021dd2bc697749e61b4df7bf147803b0a6ba0bb4e1857f2fdc423bad740148ded66ce11998095e0ab36747fe1ce0d5c128ef4a8b44312604378d8974362eefa5220f83744992c7f710c20c29fbb7bdba7fe35fd59ff2a9f474d5b8e1b3b081e4e1a563a3ccea0478906ebff7 AndroidSideloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C rclone.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 rclone.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 AndroidSideloader.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e AndroidSideloader.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 rclone.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4724 rclone.exe 4724 rclone.exe 4724 rclone.exe 4724 rclone.exe 3452 rclone.exe 3452 rclone.exe 3452 rclone.exe 3452 rclone.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 4880 AndroidSideloader.exe Token: SeRestorePrivilege 2696 7z.exe Token: 35 2696 7z.exe Token: SeSecurityPrivilege 2696 7z.exe Token: SeSecurityPrivilege 2696 7z.exe Token: SeRestorePrivilege 4716 7z.exe Token: 35 4716 7z.exe Token: SeSecurityPrivilege 4716 7z.exe Token: SeSecurityPrivilege 4716 7z.exe Token: SeDebugPrivilege 4724 rclone.exe Token: SeDebugPrivilege 3452 rclone.exe Token: SeRestorePrivilege 640 7z.exe Token: 35 640 7z.exe Token: SeSecurityPrivilege 640 7z.exe Token: SeDebugPrivilege 2736 AndroidSideloader.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 4880 wrote to memory of 2696 4880 AndroidSideloader.exe 79 PID 4880 wrote to memory of 2696 4880 AndroidSideloader.exe 79 PID 4880 wrote to memory of 4716 4880 AndroidSideloader.exe 81 PID 4880 wrote to memory of 4716 4880 AndroidSideloader.exe 81 PID 4880 wrote to memory of 1400 4880 AndroidSideloader.exe 83 PID 4880 wrote to memory of 1400 4880 AndroidSideloader.exe 83 PID 4880 wrote to memory of 1400 4880 AndroidSideloader.exe 83 PID 4880 wrote to memory of 4748 4880 AndroidSideloader.exe 85 PID 4880 wrote to memory of 4748 4880 AndroidSideloader.exe 85 PID 4880 wrote to memory of 4748 4880 AndroidSideloader.exe 85 PID 4748 wrote to memory of 4516 4748 adb.exe 87 PID 4748 wrote to memory of 4516 4748 adb.exe 87 PID 4748 wrote to memory of 4516 4748 adb.exe 87 PID 4880 wrote to memory of 4724 4880 AndroidSideloader.exe 88 PID 4880 wrote to memory of 4724 4880 AndroidSideloader.exe 88 PID 4880 wrote to memory of 3452 4880 AndroidSideloader.exe 90 PID 4880 wrote to memory of 3452 4880 AndroidSideloader.exe 90 PID 4880 wrote to memory of 640 4880 AndroidSideloader.exe 92 PID 4880 wrote to memory of 640 4880 AndroidSideloader.exe 92 PID 4880 wrote to memory of 1536 4880 AndroidSideloader.exe 94 PID 4880 wrote to memory of 1536 4880 AndroidSideloader.exe 94 PID 4880 wrote to memory of 1536 4880 AndroidSideloader.exe 94 PID 4880 wrote to memory of 2232 4880 AndroidSideloader.exe 96 PID 4880 wrote to memory of 2232 4880 AndroidSideloader.exe 96 PID 4880 wrote to memory of 2232 4880 AndroidSideloader.exe 96 PID 4880 wrote to memory of 4000 4880 AndroidSideloader.exe 98 PID 4880 wrote to memory of 4000 4880 AndroidSideloader.exe 98 PID 4880 wrote to memory of 4000 4880 AndroidSideloader.exe 98 PID 4880 wrote to memory of 60 4880 AndroidSideloader.exe 100 PID 4880 wrote to memory of 60 4880 AndroidSideloader.exe 100 PID 4880 wrote to memory of 60 4880 AndroidSideloader.exe 100 PID 4880 wrote to memory of 4768 4880 AndroidSideloader.exe 102 PID 4880 wrote to memory of 4768 4880 AndroidSideloader.exe 102 PID 4880 wrote to memory of 4768 4880 AndroidSideloader.exe 102 PID 4880 wrote to memory of 2736 4880 AndroidSideloader.exe 104 PID 4880 wrote to memory of 2736 4880 AndroidSideloader.exe 104 PID 4880 wrote to memory of 2736 4880 AndroidSideloader.exe 104 PID 2736 wrote to memory of 3532 2736 AndroidSideloader.exe 105 PID 2736 wrote to memory of 3532 2736 AndroidSideloader.exe 105 PID 2736 wrote to memory of 3532 2736 AndroidSideloader.exe 105 PID 2736 wrote to memory of 1944 2736 AndroidSideloader.exe 107 PID 2736 wrote to memory of 1944 2736 AndroidSideloader.exe 107 PID 2736 wrote to memory of 1944 2736 AndroidSideloader.exe 107 PID 1944 wrote to memory of 4472 1944 adb.exe 109 PID 1944 wrote to memory of 4472 1944 adb.exe 109 PID 1944 wrote to memory of 4472 1944 adb.exe 109 PID 2736 wrote to memory of 2916 2736 AndroidSideloader.exe 110 PID 2736 wrote to memory of 2916 2736 AndroidSideloader.exe 110 PID 2736 wrote to memory of 2916 2736 AndroidSideloader.exe 110 PID 2736 wrote to memory of 1912 2736 AndroidSideloader.exe 112 PID 2736 wrote to memory of 1912 2736 AndroidSideloader.exe 112 PID 2736 wrote to memory of 1912 2736 AndroidSideloader.exe 112 PID 2736 wrote to memory of 2492 2736 AndroidSideloader.exe 114 PID 2736 wrote to memory of 2492 2736 AndroidSideloader.exe 114 PID 2736 wrote to memory of 2492 2736 AndroidSideloader.exe 114 PID 2736 wrote to memory of 2136 2736 AndroidSideloader.exe 116 PID 2736 wrote to memory of 2136 2736 AndroidSideloader.exe 116 PID 2736 wrote to memory of 2136 2736 AndroidSideloader.exe 116 PID 2736 wrote to memory of 3684 2736 AndroidSideloader.exe 118 PID 2736 wrote to memory of 3684 2736 AndroidSideloader.exe 118 PID 2736 wrote to memory of 3684 2736 AndroidSideloader.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\AndroidSideloader.exe"C:\Users\Admin\AppData\Local\Temp\AndroidSideloader.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\7z.exe"7z.exe" x "C:\Users\Admin\AppData\Local\Temp\dependencies.7z" -y -o"C:\RSL\platform-tools" -bsp12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\7z.exe"7z.exe" x "C:\Users\Admin\AppData\Local\Temp\rclone.zip" -y -o"C:\Users\Admin\AppData\Local\Temp" -bsp12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" kill-server2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1400
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" start-server2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\RSL\platform-tools\adb.exeadb -L tcp:5037 fork-server server --reply-fd 5683⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4516
-
-
-
C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe"C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" listremotes --config vrp.download.config2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe"C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" sync ":http:/meta.7z" "C:\Users\Admin\AppData\Local\Temp" --http-url https://theapp.vrrookie.xyz/ --tpslimit 1.0 --tpslimit-burst 32⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
C:\Users\Admin\AppData\Local\Temp\7z.exe"7z.exe" x "C:\Users\Admin\AppData\Local\Temp\meta.7z" -y -o"C:\Users\Admin\AppData\Local\Temp\meta" -p"gL59VfgPxoHR" -bsp12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" devices2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" shell df2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" shell dumpsys battery2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4000
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" shell pm list packages -32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:60
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" shell df2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4768
-
-
C:\Users\Admin\AppData\Local\Temp\AndroidSideloader.exe"C:\Users\Admin\AppData\Local\Temp\AndroidSideloader.exe" --offline2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" kill-server3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3532
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" start-server3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\RSL\platform-tools\adb.exeadb -L tcp:5037 fork-server server --reply-fd 5684⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4472
-
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" devices3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" shell dumpsys battery3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" shell df3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" shell pm list packages -33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136
-
-
C:\RSL\platform-tools\adb.exe"C:\RSL\platform-tools\adb.exe" shell df3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3684
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5d79a7c0a425f768fc9f9bcf2aa144d8f
SHA13da9e4c4566bd6d4efeeaf7ceab9e9e83f2f67e5
SHA2561ad523231de449af3ba0e8664d3af332f0c5cc4f09141691ca05e35368fa811a
SHA512ff650b98ecc55df6c2cb1b22221b1e71d63c01324f8a8b0f05f1497f5416131f7c33ef2ea17ed323cb2bfdbe7ae1824474544434899d2cb89e9c8c00db7dbb15
-
Filesize
71KB
MD5e6e1716f53624aff7dbce5891334669a
SHA19c17f50ba4c8e5db9c1118d164995379f8d686fb
SHA25651a61758a6f1f13dd36530199c0d65e227cd9d43765372b2942944cc3296ca2c
SHA512c47392b6f7d701e78f78e0b0ddce5508ab8d247a4095391e77cd665e955f4938e412ffcb6076534dcad287af4f78d84668496935e71b9bb46a98401522815eb9
-
Filesize
5.6MB
MD564daf7cca61d468d26a407d79a7c26a9
SHA151b451089e73c9a03e2f24ab2fc81896d48c6126
SHA256997324a38d89e3b282306bf25ccaa167c49a35850ac0ab4a169e7a15afa82fc8
SHA5125a7bd06326e8ee868a2e6c724bc74bd290acaa00f3442807d3f69489a374a13a3cb41fbaf929c79525bdac319bd9a64ecfaf3cbdb6585ae332a485e911d8370d
-
Filesize
1KB
MD5b870ab02c3919abd25d4e7203150b9ec
SHA103f5f3d865250bbaf76eeb25d452179e6ee02a5a
SHA25660a0d286dd86908d2ab8a0f94db0c59a35b9ae898912a1ae98be14fbf26eacc4
SHA5120412e7c39a45e37e2862e0c26252f954a38f6ad08d123cd983f3c9073f7045d2e1a91671b5be830ab30e3bb41441f4765a5c84efd50ced7e1701e20c1ea3b0ce
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader.exe_Url_3wcjmuu02ugveehxxd13xxpo50icwnnk\2.0.0.0\4np13xit.newcfg
Filesize3KB
MD5c3817bd4acff63f3a97de77660cd1dab
SHA1781fb4f45d5d361dece182c94e0874bb155cb414
SHA2564a804c4b35698c4db0b8ad0d4532334a5e44cc5a21447cbcd5f4eee00d819984
SHA512fa01808b23564192dfdfd58f5c2d1b7e8915e8fafcda0fbb4cc93fc005d3bbcd23e1734cf37f90902c15d421418e1f1cd0ba1395370682521a55108598206f6c
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader.exe_Url_3wcjmuu02ugveehxxd13xxpo50icwnnk\2.0.0.0\epipcgdi.newcfg
Filesize2KB
MD5c09f0e46e40224e0fe790e8ddd4149c9
SHA12043e947fda7139dc8d5fda304a440ac38504942
SHA2561f1809fc242e93f6f5ec102bcb821e74f8f64f054a74c99ecd7705ade41ed9ba
SHA512765cf206ffaefb2b0da3cb7cb30414e9a82975f62f899181e8cbf15149d947c5c5252d46b0c70f54e172241a5a5ba1f6db3e5245b06d9ef290a985ba3ff97188
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader.exe_Url_3wcjmuu02ugveehxxd13xxpo50icwnnk\2.0.0.0\user.config
Filesize838B
MD56dc22626c68e39d1f7a92bc247d064fa
SHA106d72094b8ccfb2cd09e3b04fa79cd2f4efbb40c
SHA2565b1cfb327e8e4f605cdb650526ab442cc846ce97cfdc51d1da23dfecb3abdf60
SHA51209858fce9752da51c915859873510c5f115b8d2b2ffa9b3bfe8bee20b804de1fe3ef8bbe5448b2374d6089af29e9d7914e0098df675e5eef240d4f1649a0db72
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader.exe_Url_3wcjmuu02ugveehxxd13xxpo50icwnnk\2.0.0.0\user.config
Filesize2KB
MD5e75f6b57d6f1b508e97979281fe5add9
SHA1346cf0575ddda0baa242f1c9703e8e2a1b6e808b
SHA256e0ea81cfe7477fae9c60541c96397ddbbad7ac127bcc1537f8704931725410ee
SHA5129caa1a75b6fe240df41b50448fe172c09b46630e43b791c4fb1708644f7f51c7d02d6808e96e436fb2b299b8c6f29cb9fb6e45000526084017551b318f1036d4
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader.exe_Url_3wcjmuu02ugveehxxd13xxpo50icwnnk\2.0.0.0\user.config
Filesize3KB
MD5c48e9f18008eb9e5834857be1c510dea
SHA119a56888d1208c333de757eee5b40b93ddcf77f4
SHA256bd89a4d0dfa4f752cdad26fb8ce9aca4daae24dccb827a2de10d80ceb2a19cb2
SHA512bcfd7b43d23a5737999ad1ecc92babdd25f7536743b5e5d1d70519a8ad5b0740d2ada7fa7a452fa569fd80a9eb38e2e535a47f2f6d04701f1b93e93b949a8abc
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader.exe_Url_3wcjmuu02ugveehxxd13xxpo50icwnnk\2.0.0.0\user.config
Filesize2KB
MD578a7f11ab825926b2ccfe4fd1562a8ca
SHA14cd3a3d6a8f4e89d13407dbf59bd57b9f986259b
SHA256a0a78da7205db1a0626dc1ceb3b16222dba5133fa38039f21c886590444e96a5
SHA5128a24b9fef8e717f5a8edbde417fb16de4edc4cc0b91224508731fad04b4680113a070a22cfeecfd82c256992fade826bb68d461f8464f38b65d36282f0bca5ac
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader.exe_Url_3wcjmuu02ugveehxxd13xxpo50icwnnk\2.0.0.0\user.config
Filesize2KB
MD5768068e348d644e863160f5f3e86f484
SHA16435e316b20709dabb5e10eab0aa01fb796080de
SHA25658946cbd6f4ac989b6e3d131915d11a4c1ba9155b261098ae899bfdce23d9a72
SHA512ad778d539c7c1108ef10d071b635ca2d25186ccd5c46f3c1d812bec9eca237fa98cbafea38bdf5ed7da0cef17144f5d7b3145cc225f4b4fb6f60f7133726756b
-
C:\Users\Admin\AppData\Local\Rookie.AndroidSideloader\AndroidSideloader.exe_Url_3wcjmuu02ugveehxxd13xxpo50icwnnk\2.0.0.0\wbukaz14.newcfg
Filesize3KB
MD568ba60c5ca0b4a1c3d6b4a1e5ec97acf
SHA1da191508a2e5de5392767b8dcfe691abd43c48b7
SHA25639bd33434df7855ed25fdc25419912ff3e466cedaab02aba9578afdc0af09975
SHA5127a2435ad34323039d3832d8d4b2a2d4838fedc80ab0a6a1cb1316200563b48d40ca0d05df4400fcd10fc9c85ea4512385f336b283f38fb91f83eaddb075a334b
-
Filesize
1.2MB
MD51a7eaa1dab7867e15d7800ae0b5af5e3
SHA19e6d344bd8724aa1862f4254d8c42b7cc929a797
SHA256356bea8b6e9eb84dfa0dd8674e7c03428c641a47789df605c5bea0730de4aed2
SHA512a12373ec7ec4bac3421363f70cc593f4334b4bb5a5c917e050a45090220fab002c36ba8b03be81159fd70955b4680146c9469e44ddf75a901465d6b1231ee6cd
-
Filesize
1KB
MD5f5796ec089d9d484260f8c000a63d85a
SHA126bb8313b851c2b33be6150b7ff9f3a969958cbe
SHA25671fef2803b163b15e2d0ee28b964b683cf0f27c8e14fd1a8041562f75c9807f9
SHA5121acf5a3c5591a39acd09e18aca5a82ab519bf772620b7db44d17af44189d8e654097cc2275befde8f32dda6dbbe6dacbfb1762bdf16693cf0843c5d89ad28544
-
Filesize
5.5MB
MD554850eca0050c5468f712187828655ce
SHA130607a286efe050f9387f3127888b4073595d1a1
SHA25606e1523a9cc9be6bd9d7a33c2720519d1a071747222f044bdf0c4d590a508575
SHA51240d575da0d48f6b0ab7dbeabf68a4b40551157671e34f5669fe2627fe51d8f623e00adcff24df6abf9ea765dd02ffdcca2783b73f617ee0fb1fca1a88f0d4675
-
Filesize
20.1MB
MD510babe225d85f3da58ee8cc260b63793
SHA1900da981ad757c5b8696b71475341c9228e84be9
SHA2568e8bb13fb0d7beb316487ecde8ead5426784cdcdbf8b4d8dd381c6fe8c7d92a0
SHA512d771c4631b607fc447be37d2ee266859dec4e09aa5544559edff2dea6d277ac9a28792ef1d12875c51b48773e155a983633b9f7ad59e14a36fb36de4d7fe9246