Analysis
-
max time kernel
123s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 23:20
Behavioral task
behavioral1
Sample
01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
01e454d6f17ff28201bc92410f70afc6
-
SHA1
1b4272fab6d6f74d2ecdc3f7ab038a28ce56ece9
-
SHA256
b5586bf27b89120d315685c47b15631a4a81d96659670e9aaba0cb0f994a0c2a
-
SHA512
11730c858a59a5df9cd4d05d04789c3196eeb3ac5bd1893a11e6c56b9808b8c1e80d84ca388ef936d1a75026893bd068dbdeda136cd9de13cdbee126e92cc9ee
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZD:0UzeyQMS4DqodCnoe+iitjWww3
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 2212 explorer.exe 3208 explorer.exe 2816 spoolsv.exe 5020 spoolsv.exe 3360 spoolsv.exe 564 spoolsv.exe 1268 spoolsv.exe 2224 spoolsv.exe 4564 spoolsv.exe 3736 spoolsv.exe 1960 spoolsv.exe 3764 spoolsv.exe 1248 spoolsv.exe 2536 spoolsv.exe 3412 spoolsv.exe 4180 spoolsv.exe 3560 spoolsv.exe 1284 spoolsv.exe 4036 spoolsv.exe 1260 spoolsv.exe 3008 spoolsv.exe 2356 spoolsv.exe 3576 spoolsv.exe 3748 spoolsv.exe 1392 spoolsv.exe 1412 spoolsv.exe 3152 spoolsv.exe 3616 spoolsv.exe 4532 spoolsv.exe 1192 spoolsv.exe 4476 spoolsv.exe 624 spoolsv.exe 4660 spoolsv.exe 4780 spoolsv.exe 4088 spoolsv.exe 5092 spoolsv.exe 3296 spoolsv.exe 1456 spoolsv.exe 4624 spoolsv.exe 5012 explorer.exe 1628 spoolsv.exe 4172 spoolsv.exe 64 spoolsv.exe 5108 spoolsv.exe 2828 spoolsv.exe 4284 spoolsv.exe 2844 spoolsv.exe 4428 spoolsv.exe 744 spoolsv.exe 448 spoolsv.exe 4924 explorer.exe 4976 spoolsv.exe 1084 spoolsv.exe 2384 spoolsv.exe 860 spoolsv.exe 3592 spoolsv.exe 1544 spoolsv.exe 3016 spoolsv.exe 1940 spoolsv.exe 228 spoolsv.exe 4616 explorer.exe 3292 spoolsv.exe 3216 spoolsv.exe 1904 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 42 IoCs
description pid Process procid_target PID 4132 set thread context of 4020 4132 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 85 PID 2212 set thread context of 3208 2212 explorer.exe 88 PID 2816 set thread context of 4624 2816 spoolsv.exe 125 PID 5020 set thread context of 4172 5020 spoolsv.exe 128 PID 3360 set thread context of 64 3360 spoolsv.exe 129 PID 564 set thread context of 5108 564 spoolsv.exe 130 PID 1268 set thread context of 2828 1268 spoolsv.exe 131 PID 2224 set thread context of 4284 2224 spoolsv.exe 132 PID 4564 set thread context of 2844 4564 spoolsv.exe 133 PID 3736 set thread context of 4428 3736 spoolsv.exe 134 PID 1960 set thread context of 448 1960 spoolsv.exe 136 PID 3764 set thread context of 4976 3764 spoolsv.exe 138 PID 1248 set thread context of 1084 1248 spoolsv.exe 139 PID 2536 set thread context of 2384 2536 spoolsv.exe 140 PID 3412 set thread context of 860 3412 spoolsv.exe 141 PID 4180 set thread context of 3592 4180 spoolsv.exe 142 PID 3560 set thread context of 3016 3560 spoolsv.exe 144 PID 1284 set thread context of 1940 1284 spoolsv.exe 145 PID 4036 set thread context of 228 4036 spoolsv.exe 146 PID 1260 set thread context of 3292 1260 spoolsv.exe 148 PID 3008 set thread context of 3216 3008 spoolsv.exe 149 PID 2356 set thread context of 1904 2356 spoolsv.exe 150 PID 3576 set thread context of 1096 3576 spoolsv.exe 151 PID 3748 set thread context of 1232 3748 spoolsv.exe 152 PID 1392 set thread context of 2448 1392 spoolsv.exe 153 PID 1412 set thread context of 2152 1412 spoolsv.exe 154 PID 3152 set thread context of 4256 3152 spoolsv.exe 156 PID 3616 set thread context of 4304 3616 spoolsv.exe 157 PID 4532 set thread context of 2312 4532 spoolsv.exe 159 PID 1192 set thread context of 2464 1192 spoolsv.exe 160 PID 4476 set thread context of 4812 4476 spoolsv.exe 161 PID 624 set thread context of 2760 624 spoolsv.exe 162 PID 4660 set thread context of 408 4660 spoolsv.exe 163 PID 4780 set thread context of 5072 4780 spoolsv.exe 164 PID 4088 set thread context of 3684 4088 spoolsv.exe 166 PID 5092 set thread context of 4548 5092 spoolsv.exe 167 PID 3296 set thread context of 1560 3296 spoolsv.exe 169 PID 1456 set thread context of 3256 1456 spoolsv.exe 171 PID 5012 set thread context of 4628 5012 explorer.exe 177 PID 1628 set thread context of 2764 1628 spoolsv.exe 178 PID 744 set thread context of 4656 744 spoolsv.exe 188 PID 4924 set thread context of 5056 4924 explorer.exe 195 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4020 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 4020 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3208 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4020 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 4020 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 3208 explorer.exe 4624 spoolsv.exe 4624 spoolsv.exe 4172 spoolsv.exe 4172 spoolsv.exe 64 spoolsv.exe 64 spoolsv.exe 5108 spoolsv.exe 5108 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 4284 spoolsv.exe 4284 spoolsv.exe 2844 spoolsv.exe 2844 spoolsv.exe 4428 spoolsv.exe 4428 spoolsv.exe 448 spoolsv.exe 448 spoolsv.exe 4976 spoolsv.exe 4976 spoolsv.exe 1084 spoolsv.exe 1084 spoolsv.exe 2384 spoolsv.exe 2384 spoolsv.exe 860 spoolsv.exe 860 spoolsv.exe 3592 spoolsv.exe 3592 spoolsv.exe 3016 spoolsv.exe 3016 spoolsv.exe 1940 spoolsv.exe 1940 spoolsv.exe 228 spoolsv.exe 228 spoolsv.exe 3292 spoolsv.exe 3292 spoolsv.exe 3216 spoolsv.exe 3216 spoolsv.exe 1904 spoolsv.exe 1904 spoolsv.exe 1096 spoolsv.exe 1096 spoolsv.exe 1232 spoolsv.exe 1232 spoolsv.exe 2448 spoolsv.exe 2448 spoolsv.exe 2152 spoolsv.exe 2152 spoolsv.exe 4256 spoolsv.exe 4256 spoolsv.exe 4304 spoolsv.exe 4304 spoolsv.exe 2312 spoolsv.exe 2312 spoolsv.exe 2464 spoolsv.exe 2464 spoolsv.exe 4812 spoolsv.exe 4812 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4132 wrote to memory of 2412 4132 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 81 PID 4132 wrote to memory of 2412 4132 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 81 PID 4132 wrote to memory of 4020 4132 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 85 PID 4132 wrote to memory of 4020 4132 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 85 PID 4132 wrote to memory of 4020 4132 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 85 PID 4132 wrote to memory of 4020 4132 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 85 PID 4132 wrote to memory of 4020 4132 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 85 PID 4020 wrote to memory of 2212 4020 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 86 PID 4020 wrote to memory of 2212 4020 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 86 PID 4020 wrote to memory of 2212 4020 01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe 86 PID 2212 wrote to memory of 3208 2212 explorer.exe 88 PID 2212 wrote to memory of 3208 2212 explorer.exe 88 PID 2212 wrote to memory of 3208 2212 explorer.exe 88 PID 2212 wrote to memory of 3208 2212 explorer.exe 88 PID 2212 wrote to memory of 3208 2212 explorer.exe 88 PID 3208 wrote to memory of 2816 3208 explorer.exe 89 PID 3208 wrote to memory of 2816 3208 explorer.exe 89 PID 3208 wrote to memory of 2816 3208 explorer.exe 89 PID 3208 wrote to memory of 5020 3208 explorer.exe 90 PID 3208 wrote to memory of 5020 3208 explorer.exe 90 PID 3208 wrote to memory of 5020 3208 explorer.exe 90 PID 3208 wrote to memory of 3360 3208 explorer.exe 91 PID 3208 wrote to memory of 3360 3208 explorer.exe 91 PID 3208 wrote to memory of 3360 3208 explorer.exe 91 PID 3208 wrote to memory of 564 3208 explorer.exe 92 PID 3208 wrote to memory of 564 3208 explorer.exe 92 PID 3208 wrote to memory of 564 3208 explorer.exe 92 PID 3208 wrote to memory of 1268 3208 explorer.exe 93 PID 3208 wrote to memory of 1268 3208 explorer.exe 93 PID 3208 wrote to memory of 1268 3208 explorer.exe 93 PID 3208 wrote to memory of 2224 3208 explorer.exe 94 PID 3208 wrote to memory of 2224 3208 explorer.exe 94 PID 3208 wrote to memory of 2224 3208 explorer.exe 94 PID 3208 wrote to memory of 4564 3208 explorer.exe 95 PID 3208 wrote to memory of 4564 3208 explorer.exe 95 PID 3208 wrote to memory of 4564 3208 explorer.exe 95 PID 3208 wrote to memory of 3736 3208 explorer.exe 96 PID 3208 wrote to memory of 3736 3208 explorer.exe 96 PID 3208 wrote to memory of 3736 3208 explorer.exe 96 PID 3208 wrote to memory of 1960 3208 explorer.exe 97 PID 3208 wrote to memory of 1960 3208 explorer.exe 97 PID 3208 wrote to memory of 1960 3208 explorer.exe 97 PID 3208 wrote to memory of 3764 3208 explorer.exe 98 PID 3208 wrote to memory of 3764 3208 explorer.exe 98 PID 3208 wrote to memory of 3764 3208 explorer.exe 98 PID 3208 wrote to memory of 1248 3208 explorer.exe 99 PID 3208 wrote to memory of 1248 3208 explorer.exe 99 PID 3208 wrote to memory of 1248 3208 explorer.exe 99 PID 3208 wrote to memory of 2536 3208 explorer.exe 100 PID 3208 wrote to memory of 2536 3208 explorer.exe 100 PID 3208 wrote to memory of 2536 3208 explorer.exe 100 PID 3208 wrote to memory of 3412 3208 explorer.exe 101 PID 3208 wrote to memory of 3412 3208 explorer.exe 101 PID 3208 wrote to memory of 3412 3208 explorer.exe 101 PID 3208 wrote to memory of 4180 3208 explorer.exe 102 PID 3208 wrote to memory of 4180 3208 explorer.exe 102 PID 3208 wrote to memory of 4180 3208 explorer.exe 102 PID 3208 wrote to memory of 3560 3208 explorer.exe 103 PID 3208 wrote to memory of 3560 3208 explorer.exe 103 PID 3208 wrote to memory of 3560 3208 explorer.exe 103 PID 3208 wrote to memory of 1284 3208 explorer.exe 104 PID 3208 wrote to memory of 1284 3208 explorer.exe 104 PID 3208 wrote to memory of 1284 3208 explorer.exe 104 PID 3208 wrote to memory of 4036 3208 explorer.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2412
-
-
C:\Users\Admin\AppData\Local\Temp\01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01e454d6f17ff28201bc92410f70afc6_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2816 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4624 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5012 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4628
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4172
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3360 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:64
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5108
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1268 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2828
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4284
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2844
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3736 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4428
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:448 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4924 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5056
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4976
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1084
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2384
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:860
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3592
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3016
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1284 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1940
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:228 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4616 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4408
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1260 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3292
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3008 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3216
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1904
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3576 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1096
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3748 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1232
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2448
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2152
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3152 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4256
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3616 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4304 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1692 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5480
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2312
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2464
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4476 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4812
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:408
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4780 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5072
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4088 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3684
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5092 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4548
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3028 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1528
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3296 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1560
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3256
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3648 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5232
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1628 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2764
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2456 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5948
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:744 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4656
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2328
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1544 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3980
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2472
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1148
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4076
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2344
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6100
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:6136
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4268 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2912
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5300
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1744 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5660
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6036
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1964
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5008
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5872
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5992
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2700 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6052
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:680
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3952
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3184
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3732
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3076
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4368
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3236
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3104
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1704
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5116
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4672
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:380
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1072
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4360
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5096
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2484
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3260
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:32
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4952
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2308
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4748
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4644
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2020
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4872
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2004
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:548
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3192
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5368
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5788
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5588
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5224
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5756
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3460
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5deacf407a687d33078f983a1ec15dff3
SHA11be687aa7dacffeba7c31c6645ac1b5ababa4122
SHA25667ab2a781dc898e622dc82f64300cac07348509d9f87e93a45ca0529db68da8f
SHA512ac8c11aa3286abbd5a25a0133a1e3e0dba3b577d617aa708a04f3bd161aa0c4f4d5f73a42645600b70cfb75456b581eede0b350c7aa89319f3024f82e3b4c33e
-
Filesize
2.2MB
MD550fde445e03bd1e0a4fc4fe2c544a40b
SHA1a8ff8938ca2b54935dce706144c7f2c1218687cd
SHA2565f458cb25ce256139fc780087b9993e33d716114fe8e30e37cdda3be4f8f2dbc
SHA512ae36a38183148a1d879fa88511dc9d57c73f53b6c0cbca9c03f5882eeea40d75e0118cd3035364693b263f6759413082dd89e5136f78c396d067454d349d690b