Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-11-2024 21:50
Static task
static1
Behavioral task
behavioral1
Sample
FusionLoader v2.1.exe
Resource
win10v2004-20241007-en
General
-
Target
FusionLoader v2.1.exe
-
Size
2.2MB
-
MD5
83539ba7c5103e90cf7230812873abb5
-
SHA1
aa84fc6f29b943e714f7be00e4cc7af957484381
-
SHA256
e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1
-
SHA512
e8183cbd06ae2f1930cf7a2d417562d1c90cc1e5bbe580f0049d2b303ab4699f59981d6ab6a3f774c01dc014e9f1c7cc1933e1e6aeaea62404f42e1e07d27487
-
SSDEEP
24576:2TbBv5rUyXVijPqBdzumpuWIax7RAxXo6MA17qm8w4tBPP+3wVwLsvMlDF/3cWA3:IBJiSr41q9FtBPW3+elDNMWAgPrc7H
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 6 IoCs
Processes:
Local Security Authority Process.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\8.0.2\\sppsvc.exe\", \"C:\\Program Files\\dotnet\\host\\csrss.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\8.0.2\\sppsvc.exe\", \"C:\\Program Files\\dotnet\\host\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\WmiPrvSE.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\8.0.2\\sppsvc.exe\", \"C:\\Program Files\\dotnet\\host\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\WmiPrvSE.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\unsecapp.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\8.0.2\\sppsvc.exe\", \"C:\\Program Files\\dotnet\\host\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\WmiPrvSE.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\unsecapp.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Local Security Authority Process.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\8.0.2\\sppsvc.exe\"" Local Security Authority Process.exe -
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1416 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4380 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4800 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1376 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4672 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4356 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1176 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5068 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4608 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5032 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1248 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5028 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3636 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3608 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3144 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3580 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4424 2616 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4932 2616 schtasks.exe 92 -
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid Process 1732 powershell.exe 3344 powershell.exe 3464 powershell.exe 2600 powershell.exe 5024 powershell.exe 2204 powershell.exe 3668 powershell.exe 4680 powershell.exe 1476 powershell.exe 4220 powershell.exe 3960 powershell.exe 220 powershell.exe 924 powershell.exe 4288 powershell.exe 3312 powershell.exe 2164 powershell.exe 1996 powershell.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
FusionLoader v2.1.exeWScript.exeLocal Security Authority Process.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation FusionLoader v2.1.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Local Security Authority Process.exe -
Executes dropped EXE 2 IoCs
Processes:
Local Security Authority Process.exeLocal Security Authority Process.exepid Process 4652 Local Security Authority Process.exe 6004 Local Security Authority Process.exe -
Adds Run key to start application 2 TTPs 12 IoCs
Processes:
Local Security Authority Process.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\DigitalLocker\\en-US\\unsecapp.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Local Security Authority Process = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Local Security Authority Process.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\dotnet\\host\\fxr\\8.0.2\\sppsvc.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\dotnet\\host\\csrss.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\WmiPrvSE.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\DigitalLocker\\en-US\\unsecapp.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\WmiPrvSE.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Local Security Authority Process = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Local Security Authority Process.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\dotnet\\host\\fxr\\8.0.2\\sppsvc.exe\"" Local Security Authority Process.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\dotnet\\host\\csrss.exe\"" Local Security Authority Process.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 ipinfo.io 23 ipinfo.io -
Drops file in System32 directory 2 IoCs
Processes:
csc.exedescription ioc Process File created \??\c:\Windows\System32\CSC48B5F8AD9F1B401088C04309F6E2785.TMP csc.exe File created \??\c:\Windows\System32\-63gkj.exe csc.exe -
Drops file in Program Files directory 7 IoCs
Processes:
Local Security Authority Process.exedescription ioc Process File created C:\Program Files\dotnet\host\fxr\8.0.2\0a1fd5f707cd16 Local Security Authority Process.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\WmiPrvSE.exe Local Security Authority Process.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\24dbde2999530e Local Security Authority Process.exe File created C:\Program Files\dotnet\host\csrss.exe Local Security Authority Process.exe File created C:\Program Files\dotnet\host\886983d96e3d3e Local Security Authority Process.exe File created C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\AppxMetadata\backgroundTaskHost.exe Local Security Authority Process.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\sppsvc.exe Local Security Authority Process.exe -
Drops file in Windows directory 3 IoCs
Processes:
Local Security Authority Process.exedescription ioc Process File created C:\Windows\DigitalLocker\en-US\unsecapp.exe Local Security Authority Process.exe File opened for modification C:\Windows\DigitalLocker\en-US\unsecapp.exe Local Security Authority Process.exe File created C:\Windows\DigitalLocker\en-US\29c1c3cc0f7685 Local Security Authority Process.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
FusionLoader v2.1.exeWScript.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FusionLoader v2.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Modifies registry class 2 IoCs
Processes:
FusionLoader v2.1.exeLocal Security Authority Process.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings FusionLoader v2.1.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Local Security Authority Process.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid Process 3144 schtasks.exe 4424 schtasks.exe 1416 schtasks.exe 4380 schtasks.exe 4800 schtasks.exe 5032 schtasks.exe 1248 schtasks.exe 4608 schtasks.exe 3636 schtasks.exe 4932 schtasks.exe 1376 schtasks.exe 4356 schtasks.exe 1176 schtasks.exe 5068 schtasks.exe 3580 schtasks.exe 4672 schtasks.exe 5028 schtasks.exe 3608 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Local Security Authority Process.exepid Process 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe 4652 Local Security Authority Process.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
Local Security Authority Process.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeLocal Security Authority Process.exedescription pid Process Token: SeDebugPrivilege 4652 Local Security Authority Process.exe Token: SeDebugPrivilege 2600 powershell.exe Token: SeDebugPrivilege 3344 powershell.exe Token: SeDebugPrivilege 4680 powershell.exe Token: SeDebugPrivilege 3312 powershell.exe Token: SeDebugPrivilege 1996 powershell.exe Token: SeDebugPrivilege 220 powershell.exe Token: SeDebugPrivilege 924 powershell.exe Token: SeDebugPrivilege 2204 powershell.exe Token: SeDebugPrivilege 2164 powershell.exe Token: SeDebugPrivilege 4220 powershell.exe Token: SeDebugPrivilege 3668 powershell.exe Token: SeDebugPrivilege 5024 powershell.exe Token: SeDebugPrivilege 3464 powershell.exe Token: SeDebugPrivilege 1476 powershell.exe Token: SeDebugPrivilege 3960 powershell.exe Token: SeDebugPrivilege 1732 powershell.exe Token: SeDebugPrivilege 4288 powershell.exe Token: SeDebugPrivilege 6004 Local Security Authority Process.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
FusionLoader v2.1.exeWScript.execmd.exeLocal Security Authority Process.execsc.execmd.exedescription pid Process procid_target PID 2252 wrote to memory of 5080 2252 FusionLoader v2.1.exe 85 PID 2252 wrote to memory of 5080 2252 FusionLoader v2.1.exe 85 PID 2252 wrote to memory of 5080 2252 FusionLoader v2.1.exe 85 PID 5080 wrote to memory of 1484 5080 WScript.exe 102 PID 5080 wrote to memory of 1484 5080 WScript.exe 102 PID 5080 wrote to memory of 1484 5080 WScript.exe 102 PID 1484 wrote to memory of 4652 1484 cmd.exe 104 PID 1484 wrote to memory of 4652 1484 cmd.exe 104 PID 4652 wrote to memory of 5060 4652 Local Security Authority Process.exe 108 PID 4652 wrote to memory of 5060 4652 Local Security Authority Process.exe 108 PID 5060 wrote to memory of 1956 5060 csc.exe 110 PID 5060 wrote to memory of 1956 5060 csc.exe 110 PID 4652 wrote to memory of 4288 4652 Local Security Authority Process.exe 127 PID 4652 wrote to memory of 4288 4652 Local Security Authority Process.exe 127 PID 4652 wrote to memory of 4680 4652 Local Security Authority Process.exe 128 PID 4652 wrote to memory of 4680 4652 Local Security Authority Process.exe 128 PID 4652 wrote to memory of 3312 4652 Local Security Authority Process.exe 129 PID 4652 wrote to memory of 3312 4652 Local Security Authority Process.exe 129 PID 4652 wrote to memory of 2164 4652 Local Security Authority Process.exe 130 PID 4652 wrote to memory of 2164 4652 Local Security Authority Process.exe 130 PID 4652 wrote to memory of 1732 4652 Local Security Authority Process.exe 131 PID 4652 wrote to memory of 1732 4652 Local Security Authority Process.exe 131 PID 4652 wrote to memory of 2600 4652 Local Security Authority Process.exe 133 PID 4652 wrote to memory of 2600 4652 Local Security Authority Process.exe 133 PID 4652 wrote to memory of 924 4652 Local Security Authority Process.exe 134 PID 4652 wrote to memory of 924 4652 Local Security Authority Process.exe 134 PID 4652 wrote to memory of 1996 4652 Local Security Authority Process.exe 135 PID 4652 wrote to memory of 1996 4652 Local Security Authority Process.exe 135 PID 4652 wrote to memory of 3464 4652 Local Security Authority Process.exe 136 PID 4652 wrote to memory of 3464 4652 Local Security Authority Process.exe 136 PID 4652 wrote to memory of 3668 4652 Local Security Authority Process.exe 137 PID 4652 wrote to memory of 3668 4652 Local Security Authority Process.exe 137 PID 4652 wrote to memory of 1476 4652 Local Security Authority Process.exe 138 PID 4652 wrote to memory of 1476 4652 Local Security Authority Process.exe 138 PID 4652 wrote to memory of 220 4652 Local Security Authority Process.exe 139 PID 4652 wrote to memory of 220 4652 Local Security Authority Process.exe 139 PID 4652 wrote to memory of 3344 4652 Local Security Authority Process.exe 140 PID 4652 wrote to memory of 3344 4652 Local Security Authority Process.exe 140 PID 4652 wrote to memory of 3960 4652 Local Security Authority Process.exe 141 PID 4652 wrote to memory of 3960 4652 Local Security Authority Process.exe 141 PID 4652 wrote to memory of 2204 4652 Local Security Authority Process.exe 142 PID 4652 wrote to memory of 2204 4652 Local Security Authority Process.exe 142 PID 4652 wrote to memory of 5024 4652 Local Security Authority Process.exe 148 PID 4652 wrote to memory of 5024 4652 Local Security Authority Process.exe 148 PID 4652 wrote to memory of 4220 4652 Local Security Authority Process.exe 149 PID 4652 wrote to memory of 4220 4652 Local Security Authority Process.exe 149 PID 4652 wrote to memory of 444 4652 Local Security Authority Process.exe 162 PID 4652 wrote to memory of 444 4652 Local Security Authority Process.exe 162 PID 444 wrote to memory of 6072 444 cmd.exe 166 PID 444 wrote to memory of 6072 444 cmd.exe 166 PID 444 wrote to memory of 5740 444 cmd.exe 169 PID 444 wrote to memory of 5740 444 cmd.exe 169 PID 444 wrote to memory of 6004 444 cmd.exe 174 PID 444 wrote to memory of 6004 444 cmd.exe 174 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FusionLoader v2.1.exe"C:\Users\Admin\AppData\Local\Temp\FusionLoader v2.1.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\qp9vGmuwSr0nkeo7qSVAnhO3kZyMkfu12RZ0OBiQNAI58E5ZggR.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Microsoft\ZkitL4SswB6Acn9KQ4n8phMXm8v73bXNMxhzpq69L79HkSe5Tb.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe"C:\Users\Admin\AppData\Roaming\Microsoft/Local Security Authority Process.exe"4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gs2mdlme\gs2mdlme.cmdline"5⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF750.tmp" "c:\Windows\System32\CSC48B5F8AD9F1B401088C04309F6E2785.TMP"6⤵PID:1956
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:924
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\host\fxr\8.0.2\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3344
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\host\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\it-IT\WmiPrvSE.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L9bl92qG1B.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\system32\chcp.comchcp 650016⤵PID:6072
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5740
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6004
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\host\fxr\8.0.2\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\fxr\8.0.2\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\dotnet\host\fxr\8.0.2\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\dotnet\host\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\dotnet\host\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Windows\DigitalLocker\en-US\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Windows\DigitalLocker\en-US\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Local Security Authority ProcessL" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Local Security Authority Process" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Local Security Authority ProcessL" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cb4338b342d00bfe6111ffee5cbfc2ed
SHA1fc16673b6833ad3cb00743a32868b859e90aa536
SHA256343ed6661687e81c9615dcaea42fb1a98b70572bb9fe07e16f020108725dbbe9
SHA5124bcea1366b8be00d08eb15cfd78c87e1c8f3aea140a4ea30efb3c0511cd3de21b7ce8c933c7478fb06a356573ecb928e50df23d340fbd9a6e6c156a004d2a77a
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
Filesize
944B
MD59611cc3fb39fedd4b0e81d90b044531c
SHA1e35c10c1c1e29d44222114e0f72d58b3072880fd
SHA2562090eae25be03e07ff54e5ab9d219902fb80e8c1f6fe52e73c9a4afcf5eec5ec
SHA51292cf8fdd0353dd1e04856b6642483ac426ea32113a0b7436cf8224623912ae2f31078c7e70cef1c67f859504bd29e05f9af69f06533725e57244063e89e4954d
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD561e06aa7c42c7b2a752516bcbb242cc1
SHA102c54f8b171ef48cad21819c20b360448418a068
SHA2565bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d
SHA51203731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346
-
Filesize
205B
MD57620d5136fa700e01debcb63c48db70a
SHA19891fbbe97aa2e7fba1ec16e888aae99253b1986
SHA25644c35e4390e006ad7107ee77f588d0bad0252c6318e24004b9e8c9dd4ccfec17
SHA51252d4c3de0a13bcf2ac4460e30c57b502f9eac049c79a46124c6cc3399247ef145cd78932b68a225b8350caa04068b116c59c345e72435ace8525ef97752f866b
-
Filesize
1KB
MD5a9e325200ec5f6f0a1abdb8b9c6e05f1
SHA198125a9291ea84b7fc01d3b860e3893547fdc91c
SHA2568bdbdf91244647e8c6a7e460d734a729e49817704978fdc58481d933eafea87a
SHA512dc2d16a64d059c593ba395f0a4054a70af9fc1514f2ea7a87e0d923cc8e7cf6ca9aa0e15ec4536fdce896aaa7d733fa171cd82ab444b7c2ddcda06f5fe46f213
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.9MB
MD54ba31fe7c90af2148e83fe198cf99d7b
SHA1bd86eece0e892752950a13282cb323e0775ecae4
SHA256196706cf85ccf38343444deecaeaced58faf7c22963fe45aaa8ea9938fe19a0e
SHA51279991360ad8d5c8968f2aa4836b3b7b39074c99ad28aa25cc69931c4bdf2115921042d818d4cc319984cfa0ed8a9ee015506f3b4b8c026aeda82c5b03a5328f7
-
Filesize
93B
MD5fb55729d3f331e20fb5c1e5377634743
SHA1ad5d1b461d7608598e2683d66eeee3c2a38c625f
SHA2568603cadb532a5ab019b7f07a2c9652905a459f88c8cfe74d387f0d9594f323c9
SHA5122ed609b4ad5d0d9da2d12c12947091e0ce2937a12856d95979a7d2c4248b1d5244e5fc3616d0be8a1fd8febc888eeb0bb6fe08fe38a359ceb2345510645d1870
-
Filesize
245B
MD5dde897c67a0ad3384e01f44658e986d0
SHA151e5a863d22d2305da3d6e82ed2da727a6db5ffa
SHA256f3ea38d1aea5a693f1b87b3d1152f8a1de82391b34e2061ee0fbb29f2ec6dc57
SHA512901990365c1539d432871ef01d36261f537e0928e3afbd93f0833d04355a55464dbe2ca07c59d7d495bb93ad0bf73ed33db748e5856d75941c18f232503c1892
-
Filesize
370B
MD5a540ab8c06bc99fa5fd7d7853a6b7531
SHA147878235a7db45673c8703a0d836dc0dc16aca76
SHA25665164497db9202b421972efe94d4fd33f42282abdcd1f8a0e4aaeae73c8ec44c
SHA51233303bf964c855051534c449c531eebcaa190a024aea951b592dc3f771f14560828721cf1395dcd82066302a31535dab244c0f7fac961d27614a17810213eec7
-
Filesize
235B
MD5ad7a9c3a227810dbb4340250cad3a978
SHA1ad64fb27a2bd4b6074af746baad15765d2cbd8f5
SHA25637536723c0c86aa4f610deaecd54708450eb078286a0333557780a854031501c
SHA512c34332929d26875122f090b6adb956bf894fbbbeb822440a6aad7516da967a1cae7d4e0577f3d06c1d65e35ec90682cf764295735750f43ef850c8a09db299da
-
Filesize
1KB
MD582a7b8ef3bc275711e3b27c6df93c7ff
SHA1bdac909f26475c94c74145576bcf22adb0f8203c
SHA256582921e5e6617cb736006c46c9c8576d8fdefb8763469bdbf305d52d298f6124
SHA512f2100bca60280f6ad93f40254d6fe69bd9917a44973516874aa54c28042796503daac5c51869924f5ecd17615f461dda6441f479e1201c44ad07f5a7728af248