Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 23:34
Behavioral task
behavioral1
Sample
01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
01eac0ba84dfb2f57f797d65d91b49dd
-
SHA1
2d92cc1a6443834f826590131619fbf96493f9dd
-
SHA256
67e92d052234814634747594078397436044bed8a9ae103198aaf5cd69a023c2
-
SHA512
365cd43b3b06ac14efde82d54c1922cf0c1d8ce44da61408228bcdd9ff9791ccd65195522ded6885155c9ea3db4feb33369ab2b4fba2ee2192b3b749572aba6e
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwx
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3224 explorer.exe 1696 explorer.exe 1352 spoolsv.exe 320 spoolsv.exe 4384 spoolsv.exe 532 spoolsv.exe 4000 spoolsv.exe 4356 spoolsv.exe 4492 spoolsv.exe 5064 spoolsv.exe 3212 spoolsv.exe 4788 spoolsv.exe 4160 spoolsv.exe 3512 spoolsv.exe 4864 spoolsv.exe 4216 spoolsv.exe 1600 spoolsv.exe 4884 spoolsv.exe 3504 spoolsv.exe 4376 spoolsv.exe 2248 spoolsv.exe 2648 spoolsv.exe 1392 spoolsv.exe 4824 spoolsv.exe 2716 spoolsv.exe 3532 spoolsv.exe 4416 spoolsv.exe 4296 spoolsv.exe 5048 spoolsv.exe 1208 spoolsv.exe 4104 spoolsv.exe 4100 spoolsv.exe 4984 explorer.exe 4812 spoolsv.exe 3176 spoolsv.exe 4676 spoolsv.exe 4140 spoolsv.exe 3316 explorer.exe 4236 spoolsv.exe 4964 spoolsv.exe 3756 spoolsv.exe 408 spoolsv.exe 3768 spoolsv.exe 2768 spoolsv.exe 2640 explorer.exe 2664 spoolsv.exe 4872 spoolsv.exe 1180 spoolsv.exe 1824 spoolsv.exe 4556 explorer.exe 4524 spoolsv.exe 5032 spoolsv.exe 2628 spoolsv.exe 1960 spoolsv.exe 976 spoolsv.exe 1456 spoolsv.exe 4052 spoolsv.exe 3752 explorer.exe 1400 spoolsv.exe 1728 spoolsv.exe 2880 spoolsv.exe 5028 spoolsv.exe 4732 spoolsv.exe 1512 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 50 IoCs
description pid Process procid_target PID 516 set thread context of 4608 516 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 88 PID 3224 set thread context of 1696 3224 explorer.exe 99 PID 1352 set thread context of 4100 1352 spoolsv.exe 129 PID 320 set thread context of 4812 320 spoolsv.exe 131 PID 4384 set thread context of 4676 4384 spoolsv.exe 133 PID 532 set thread context of 4140 532 spoolsv.exe 134 PID 4000 set thread context of 4236 4000 spoolsv.exe 136 PID 4356 set thread context of 4964 4356 spoolsv.exe 137 PID 4492 set thread context of 408 4492 spoolsv.exe 139 PID 5064 set thread context of 3768 5064 spoolsv.exe 140 PID 3212 set thread context of 2768 3212 spoolsv.exe 141 PID 4788 set thread context of 4872 4788 spoolsv.exe 144 PID 4160 set thread context of 1180 4160 spoolsv.exe 145 PID 3512 set thread context of 1824 3512 spoolsv.exe 146 PID 4864 set thread context of 4524 4864 spoolsv.exe 148 PID 4216 set thread context of 2628 4216 spoolsv.exe 150 PID 1600 set thread context of 1960 1600 spoolsv.exe 151 PID 4884 set thread context of 976 4884 spoolsv.exe 152 PID 3504 set thread context of 4052 3504 spoolsv.exe 154 PID 4376 set thread context of 1400 4376 spoolsv.exe 156 PID 2248 set thread context of 1728 2248 spoolsv.exe 157 PID 2648 set thread context of 2880 2648 spoolsv.exe 158 PID 1392 set thread context of 5028 1392 spoolsv.exe 159 PID 4824 set thread context of 1512 4824 spoolsv.exe 161 PID 2716 set thread context of 1916 2716 spoolsv.exe 163 PID 3532 set thread context of 1508 3532 spoolsv.exe 164 PID 4416 set thread context of 3164 4416 spoolsv.exe 165 PID 4296 set thread context of 3420 4296 spoolsv.exe 167 PID 5048 set thread context of 4592 5048 spoolsv.exe 168 PID 1208 set thread context of 4792 1208 spoolsv.exe 171 PID 4104 set thread context of 3964 4104 spoolsv.exe 173 PID 4984 set thread context of 4992 4984 explorer.exe 176 PID 3176 set thread context of 376 3176 spoolsv.exe 178 PID 3316 set thread context of 428 3316 explorer.exe 181 PID 3756 set thread context of 1940 3756 spoolsv.exe 183 PID 2640 set thread context of 3360 2640 explorer.exe 187 PID 2664 set thread context of 224 2664 spoolsv.exe 189 PID 4556 set thread context of 3976 4556 explorer.exe 194 PID 5032 set thread context of 2708 5032 spoolsv.exe 195 PID 1456 set thread context of 4168 1456 spoolsv.exe 200 PID 3752 set thread context of 3760 3752 explorer.exe 202 PID 4732 set thread context of 3140 4732 spoolsv.exe 206 PID 4504 set thread context of 1032 4504 explorer.exe 209 PID 4300 set thread context of 3288 4300 spoolsv.exe 211 PID 4916 set thread context of 3880 4916 explorer.exe 213 PID 4856 set thread context of 2144 4856 spoolsv.exe 214 PID 456 set thread context of 4832 456 spoolsv.exe 216 PID 1588 set thread context of 592 1588 explorer.exe 218 PID 4796 set thread context of 1736 4796 spoolsv.exe 219 PID 4784 set thread context of 4112 4784 spoolsv.exe 221 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4608 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 4608 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1696 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4608 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 4608 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 4100 spoolsv.exe 4100 spoolsv.exe 4812 spoolsv.exe 4812 spoolsv.exe 4676 spoolsv.exe 4676 spoolsv.exe 4140 spoolsv.exe 4140 spoolsv.exe 4236 spoolsv.exe 4236 spoolsv.exe 4964 spoolsv.exe 4964 spoolsv.exe 408 spoolsv.exe 408 spoolsv.exe 3768 spoolsv.exe 3768 spoolsv.exe 2768 spoolsv.exe 2768 spoolsv.exe 4872 spoolsv.exe 4872 spoolsv.exe 1180 spoolsv.exe 1180 spoolsv.exe 1824 spoolsv.exe 1824 spoolsv.exe 4524 spoolsv.exe 4524 spoolsv.exe 2628 spoolsv.exe 2628 spoolsv.exe 1960 spoolsv.exe 1960 spoolsv.exe 976 spoolsv.exe 976 spoolsv.exe 4052 spoolsv.exe 4052 spoolsv.exe 1400 spoolsv.exe 1400 spoolsv.exe 1728 spoolsv.exe 1728 spoolsv.exe 2880 spoolsv.exe 2880 spoolsv.exe 5028 spoolsv.exe 5028 spoolsv.exe 1512 spoolsv.exe 1512 spoolsv.exe 1916 spoolsv.exe 1916 spoolsv.exe 1508 spoolsv.exe 1508 spoolsv.exe 3164 spoolsv.exe 3164 spoolsv.exe 3420 spoolsv.exe 3420 spoolsv.exe 4592 spoolsv.exe 4592 spoolsv.exe 4792 spoolsv.exe 4792 spoolsv.exe 3964 spoolsv.exe 3964 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 516 wrote to memory of 1380 516 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 83 PID 516 wrote to memory of 1380 516 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 83 PID 516 wrote to memory of 4608 516 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 88 PID 516 wrote to memory of 4608 516 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 88 PID 516 wrote to memory of 4608 516 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 88 PID 516 wrote to memory of 4608 516 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 88 PID 516 wrote to memory of 4608 516 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 88 PID 4608 wrote to memory of 3224 4608 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 89 PID 4608 wrote to memory of 3224 4608 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 89 PID 4608 wrote to memory of 3224 4608 01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe 89 PID 3224 wrote to memory of 1696 3224 explorer.exe 99 PID 3224 wrote to memory of 1696 3224 explorer.exe 99 PID 3224 wrote to memory of 1696 3224 explorer.exe 99 PID 3224 wrote to memory of 1696 3224 explorer.exe 99 PID 3224 wrote to memory of 1696 3224 explorer.exe 99 PID 1696 wrote to memory of 1352 1696 explorer.exe 100 PID 1696 wrote to memory of 1352 1696 explorer.exe 100 PID 1696 wrote to memory of 1352 1696 explorer.exe 100 PID 1696 wrote to memory of 320 1696 explorer.exe 101 PID 1696 wrote to memory of 320 1696 explorer.exe 101 PID 1696 wrote to memory of 320 1696 explorer.exe 101 PID 1696 wrote to memory of 4384 1696 explorer.exe 102 PID 1696 wrote to memory of 4384 1696 explorer.exe 102 PID 1696 wrote to memory of 4384 1696 explorer.exe 102 PID 1696 wrote to memory of 532 1696 explorer.exe 103 PID 1696 wrote to memory of 532 1696 explorer.exe 103 PID 1696 wrote to memory of 532 1696 explorer.exe 103 PID 1696 wrote to memory of 4000 1696 explorer.exe 104 PID 1696 wrote to memory of 4000 1696 explorer.exe 104 PID 1696 wrote to memory of 4000 1696 explorer.exe 104 PID 1696 wrote to memory of 4356 1696 explorer.exe 105 PID 1696 wrote to memory of 4356 1696 explorer.exe 105 PID 1696 wrote to memory of 4356 1696 explorer.exe 105 PID 1696 wrote to memory of 4492 1696 explorer.exe 106 PID 1696 wrote to memory of 4492 1696 explorer.exe 106 PID 1696 wrote to memory of 4492 1696 explorer.exe 106 PID 1696 wrote to memory of 5064 1696 explorer.exe 107 PID 1696 wrote to memory of 5064 1696 explorer.exe 107 PID 1696 wrote to memory of 5064 1696 explorer.exe 107 PID 1696 wrote to memory of 3212 1696 explorer.exe 108 PID 1696 wrote to memory of 3212 1696 explorer.exe 108 PID 1696 wrote to memory of 3212 1696 explorer.exe 108 PID 1696 wrote to memory of 4788 1696 explorer.exe 109 PID 1696 wrote to memory of 4788 1696 explorer.exe 109 PID 1696 wrote to memory of 4788 1696 explorer.exe 109 PID 1696 wrote to memory of 4160 1696 explorer.exe 110 PID 1696 wrote to memory of 4160 1696 explorer.exe 110 PID 1696 wrote to memory of 4160 1696 explorer.exe 110 PID 1696 wrote to memory of 3512 1696 explorer.exe 111 PID 1696 wrote to memory of 3512 1696 explorer.exe 111 PID 1696 wrote to memory of 3512 1696 explorer.exe 111 PID 1696 wrote to memory of 4864 1696 explorer.exe 112 PID 1696 wrote to memory of 4864 1696 explorer.exe 112 PID 1696 wrote to memory of 4864 1696 explorer.exe 112 PID 1696 wrote to memory of 4216 1696 explorer.exe 113 PID 1696 wrote to memory of 4216 1696 explorer.exe 113 PID 1696 wrote to memory of 4216 1696 explorer.exe 113 PID 1696 wrote to memory of 1600 1696 explorer.exe 114 PID 1696 wrote to memory of 1600 1696 explorer.exe 114 PID 1696 wrote to memory of 1600 1696 explorer.exe 114 PID 1696 wrote to memory of 4884 1696 explorer.exe 115 PID 1696 wrote to memory of 4884 1696 explorer.exe 115 PID 1696 wrote to memory of 4884 1696 explorer.exe 115 PID 1696 wrote to memory of 3504 1696 explorer.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1380
-
-
C:\Users\Admin\AppData\Local\Temp\01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01eac0ba84dfb2f57f797d65d91b49dd_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1352 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4100 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4984 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4992
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:320 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4812
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4384 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4676
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4140 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3316 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:428
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4236
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4964
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4492 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:408
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3768
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2768 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2640 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3360
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4872
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4160 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1180
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3512 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1824 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4556 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3976
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4524
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1600 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4884 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:976
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4052 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3752 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3760
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4376 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1400
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2880
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5028
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4824 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1512 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4504 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1032
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2716 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1916
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1508
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4416 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3164
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4296 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3420
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5048 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4592 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4916 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3880
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4792
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3964 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1588 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:592
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3176 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:376
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1188 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2188
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1940
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1936 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3764
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2664 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:224
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4736
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2708
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4776
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4168
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:528
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4732 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3140
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2928
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4300 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3288
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2732
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2144
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4832
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3556
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1736
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4112
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3292
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4544 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3384
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:896
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3020
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5084
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4960
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4580
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:396
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:408
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:468
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2564
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3652
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3768
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4472
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2380
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2108
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1080
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3040
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3248
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3376
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:980
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2992
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4060
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4080
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2700
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2228
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD54b9f982cc9d6d87b51bb343deeceec17
SHA1a014263f495b18689721df42e32503d3d864b11e
SHA2564a157d44cc9a70bcf3378dc1bef173dd380e47c57edc32f866abbd005f053234
SHA512d98ce1a7a7a689d6af7b398605de85a909aa9bc5cdc6d5b1ad4225ba431140c1dfee8c86328d267213d6d6692c99700e52ceef0bbdb1cdb841fe82bfa5f588fa
-
Filesize
2.2MB
MD5b1a4169e47d1ef1cb12c3b73e4b3a1e7
SHA1960f877639e9990220ece295ac2da2c480c788f1
SHA25643718673596f19629fc671e45a2efa1534bdc48a08feeb82c3a731b18e17b5c2
SHA512906c2ba2a88869815194a746fb760219f4df4b0802fae149acbf7a56d70813ea5dc95e4ce8fcb78ae25bf3bf2f9081ef32e75249d8cdb8ded7ae33280a90e9b7