Analysis
-
max time kernel
147s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 13:13
Behavioral task
behavioral1
Sample
00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
00d862e519b028c60745a7d6fe126427
-
SHA1
358e9d1ea8f243071f946cbc5f1ee4fb3f15a6fb
-
SHA256
5ee0ae20d61ea2a82323f194ccc9eed4fcf68315aa08e4ef5fa2e3553d184390
-
SHA512
b317a34fbc64ec84c246d827e2aa509a50f827e300280ad1b97a706aad73e801707a3fb2c48db623e3c702aaa6d596aeab46e06aedb6184d51f15983f37523b3
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZt:0UzeyQMS4DqodCnoe+iitjWwwB
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3460 explorer.exe 4964 explorer.exe 3056 spoolsv.exe 2084 spoolsv.exe 3120 spoolsv.exe 2544 spoolsv.exe 3260 spoolsv.exe 2540 spoolsv.exe 2828 spoolsv.exe 5048 spoolsv.exe 1996 spoolsv.exe 4404 spoolsv.exe 3624 spoolsv.exe 4992 spoolsv.exe 4116 spoolsv.exe 4632 spoolsv.exe 4344 spoolsv.exe 708 spoolsv.exe 3560 spoolsv.exe 1852 spoolsv.exe 1680 spoolsv.exe 4380 spoolsv.exe 1896 spoolsv.exe 4576 spoolsv.exe 4572 spoolsv.exe 1264 spoolsv.exe 636 spoolsv.exe 1600 spoolsv.exe 2584 spoolsv.exe 4552 spoolsv.exe 1508 spoolsv.exe 2752 spoolsv.exe 4716 spoolsv.exe 1120 explorer.exe 5036 spoolsv.exe 4104 spoolsv.exe 3016 spoolsv.exe 1900 spoolsv.exe 3508 spoolsv.exe 2988 spoolsv.exe 220 explorer.exe 4336 spoolsv.exe 548 spoolsv.exe 1888 spoolsv.exe 4092 spoolsv.exe 4972 spoolsv.exe 2688 spoolsv.exe 3536 spoolsv.exe 3248 spoolsv.exe 2260 explorer.exe 4628 spoolsv.exe 1804 spoolsv.exe 4928 spoolsv.exe 648 spoolsv.exe 1788 spoolsv.exe 3516 spoolsv.exe 848 explorer.exe 4528 spoolsv.exe 1536 spoolsv.exe 5020 spoolsv.exe 4328 spoolsv.exe 2736 explorer.exe 3952 spoolsv.exe 3504 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 55 IoCs
description pid Process procid_target PID 4428 set thread context of 2308 4428 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 88 PID 3460 set thread context of 4964 3460 explorer.exe 93 PID 3056 set thread context of 4716 3056 spoolsv.exe 125 PID 2084 set thread context of 5036 2084 spoolsv.exe 127 PID 3120 set thread context of 3016 3120 spoolsv.exe 129 PID 2544 set thread context of 1900 2544 spoolsv.exe 130 PID 3260 set thread context of 3508 3260 spoolsv.exe 131 PID 2540 set thread context of 2988 2540 spoolsv.exe 132 PID 2828 set thread context of 548 2828 spoolsv.exe 135 PID 5048 set thread context of 1888 5048 spoolsv.exe 136 PID 1996 set thread context of 4092 1996 spoolsv.exe 137 PID 4404 set thread context of 4972 4404 spoolsv.exe 138 PID 3624 set thread context of 2688 3624 spoolsv.exe 139 PID 4992 set thread context of 3536 4992 spoolsv.exe 140 PID 4116 set thread context of 3248 4116 spoolsv.exe 141 PID 4632 set thread context of 1804 4632 spoolsv.exe 144 PID 4344 set thread context of 4928 4344 spoolsv.exe 145 PID 708 set thread context of 648 708 spoolsv.exe 146 PID 3560 set thread context of 3516 3560 spoolsv.exe 148 PID 1852 set thread context of 4528 1852 spoolsv.exe 150 PID 1680 set thread context of 1536 1680 spoolsv.exe 151 PID 4380 set thread context of 5020 4380 spoolsv.exe 152 PID 1896 set thread context of 4328 1896 spoolsv.exe 153 PID 4576 set thread context of 3504 4576 spoolsv.exe 156 PID 4572 set thread context of 3860 4572 spoolsv.exe 157 PID 1264 set thread context of 4748 1264 spoolsv.exe 158 PID 636 set thread context of 1596 636 spoolsv.exe 159 PID 1600 set thread context of 3868 1600 spoolsv.exe 160 PID 2584 set thread context of 964 2584 spoolsv.exe 162 PID 4552 set thread context of 3468 4552 spoolsv.exe 164 PID 1508 set thread context of 2292 1508 spoolsv.exe 165 PID 2752 set thread context of 2920 2752 spoolsv.exe 167 PID 1120 set thread context of 3096 1120 explorer.exe 172 PID 4104 set thread context of 4792 4104 spoolsv.exe 174 PID 220 set thread context of 4080 220 explorer.exe 181 PID 4336 set thread context of 4884 4336 spoolsv.exe 182 PID 2260 set thread context of 2620 2260 explorer.exe 186 PID 4628 set thread context of 2444 4628 spoolsv.exe 187 PID 848 set thread context of 3272 848 explorer.exe 192 PID 1788 set thread context of 4264 1788 spoolsv.exe 193 PID 2736 set thread context of 724 2736 explorer.exe 199 PID 3952 set thread context of 1932 3952 spoolsv.exe 201 PID 2460 set thread context of 2264 2460 explorer.exe 204 PID 4272 set thread context of 1416 4272 spoolsv.exe 205 PID 2852 set thread context of 1420 2852 spoolsv.exe 209 PID 2796 set thread context of 4620 2796 explorer.exe 211 PID 4820 set thread context of 4396 4820 spoolsv.exe 212 PID 5068 set thread context of 3788 5068 spoolsv.exe 213 PID 1176 set thread context of 1528 1176 spoolsv.exe 214 PID 2204 set thread context of 3252 2204 spoolsv.exe 216 PID 4308 set thread context of 2272 4308 explorer.exe 217 PID 4416 set thread context of 3904 4416 spoolsv.exe 218 PID 1160 set thread context of 1684 1160 spoolsv.exe 219 PID 3828 set thread context of 1472 3828 spoolsv.exe 221 PID 2208 set thread context of 392 2208 spoolsv.exe 222 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2308 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 2308 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4964 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2308 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 2308 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4964 explorer.exe 4716 spoolsv.exe 4716 spoolsv.exe 5036 spoolsv.exe 5036 spoolsv.exe 3016 spoolsv.exe 3016 spoolsv.exe 1900 spoolsv.exe 1900 spoolsv.exe 3508 spoolsv.exe 3508 spoolsv.exe 2988 spoolsv.exe 2988 spoolsv.exe 548 spoolsv.exe 548 spoolsv.exe 1888 spoolsv.exe 1888 spoolsv.exe 4092 spoolsv.exe 4092 spoolsv.exe 4972 spoolsv.exe 4972 spoolsv.exe 2688 spoolsv.exe 2688 spoolsv.exe 3536 spoolsv.exe 3536 spoolsv.exe 3248 spoolsv.exe 3248 spoolsv.exe 1804 spoolsv.exe 1804 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 648 spoolsv.exe 648 spoolsv.exe 3516 spoolsv.exe 3516 spoolsv.exe 4528 spoolsv.exe 4528 spoolsv.exe 1536 spoolsv.exe 1536 spoolsv.exe 5020 spoolsv.exe 5020 spoolsv.exe 4328 spoolsv.exe 4328 spoolsv.exe 3504 spoolsv.exe 3504 spoolsv.exe 3860 spoolsv.exe 3860 spoolsv.exe 4748 spoolsv.exe 4748 spoolsv.exe 1596 spoolsv.exe 1596 spoolsv.exe 3868 spoolsv.exe 3868 spoolsv.exe 964 spoolsv.exe 964 spoolsv.exe 3468 spoolsv.exe 3468 spoolsv.exe 2292 spoolsv.exe 2292 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4428 wrote to memory of 1312 4428 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 83 PID 4428 wrote to memory of 1312 4428 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 83 PID 4428 wrote to memory of 2308 4428 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 88 PID 4428 wrote to memory of 2308 4428 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 88 PID 4428 wrote to memory of 2308 4428 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 88 PID 4428 wrote to memory of 2308 4428 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 88 PID 4428 wrote to memory of 2308 4428 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 88 PID 2308 wrote to memory of 3460 2308 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 89 PID 2308 wrote to memory of 3460 2308 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 89 PID 2308 wrote to memory of 3460 2308 00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe 89 PID 3460 wrote to memory of 4964 3460 explorer.exe 93 PID 3460 wrote to memory of 4964 3460 explorer.exe 93 PID 3460 wrote to memory of 4964 3460 explorer.exe 93 PID 3460 wrote to memory of 4964 3460 explorer.exe 93 PID 3460 wrote to memory of 4964 3460 explorer.exe 93 PID 4964 wrote to memory of 3056 4964 explorer.exe 94 PID 4964 wrote to memory of 3056 4964 explorer.exe 94 PID 4964 wrote to memory of 3056 4964 explorer.exe 94 PID 4964 wrote to memory of 2084 4964 explorer.exe 95 PID 4964 wrote to memory of 2084 4964 explorer.exe 95 PID 4964 wrote to memory of 2084 4964 explorer.exe 95 PID 4964 wrote to memory of 3120 4964 explorer.exe 96 PID 4964 wrote to memory of 3120 4964 explorer.exe 96 PID 4964 wrote to memory of 3120 4964 explorer.exe 96 PID 4964 wrote to memory of 2544 4964 explorer.exe 97 PID 4964 wrote to memory of 2544 4964 explorer.exe 97 PID 4964 wrote to memory of 2544 4964 explorer.exe 97 PID 4964 wrote to memory of 3260 4964 explorer.exe 98 PID 4964 wrote to memory of 3260 4964 explorer.exe 98 PID 4964 wrote to memory of 3260 4964 explorer.exe 98 PID 4964 wrote to memory of 2540 4964 explorer.exe 99 PID 4964 wrote to memory of 2540 4964 explorer.exe 99 PID 4964 wrote to memory of 2540 4964 explorer.exe 99 PID 4964 wrote to memory of 2828 4964 explorer.exe 100 PID 4964 wrote to memory of 2828 4964 explorer.exe 100 PID 4964 wrote to memory of 2828 4964 explorer.exe 100 PID 4964 wrote to memory of 5048 4964 explorer.exe 101 PID 4964 wrote to memory of 5048 4964 explorer.exe 101 PID 4964 wrote to memory of 5048 4964 explorer.exe 101 PID 4964 wrote to memory of 1996 4964 explorer.exe 102 PID 4964 wrote to memory of 1996 4964 explorer.exe 102 PID 4964 wrote to memory of 1996 4964 explorer.exe 102 PID 4964 wrote to memory of 4404 4964 explorer.exe 103 PID 4964 wrote to memory of 4404 4964 explorer.exe 103 PID 4964 wrote to memory of 4404 4964 explorer.exe 103 PID 4964 wrote to memory of 3624 4964 explorer.exe 104 PID 4964 wrote to memory of 3624 4964 explorer.exe 104 PID 4964 wrote to memory of 3624 4964 explorer.exe 104 PID 4964 wrote to memory of 4992 4964 explorer.exe 105 PID 4964 wrote to memory of 4992 4964 explorer.exe 105 PID 4964 wrote to memory of 4992 4964 explorer.exe 105 PID 4964 wrote to memory of 4116 4964 explorer.exe 107 PID 4964 wrote to memory of 4116 4964 explorer.exe 107 PID 4964 wrote to memory of 4116 4964 explorer.exe 107 PID 4964 wrote to memory of 4632 4964 explorer.exe 108 PID 4964 wrote to memory of 4632 4964 explorer.exe 108 PID 4964 wrote to memory of 4632 4964 explorer.exe 108 PID 4964 wrote to memory of 4344 4964 explorer.exe 109 PID 4964 wrote to memory of 4344 4964 explorer.exe 109 PID 4964 wrote to memory of 4344 4964 explorer.exe 109 PID 4964 wrote to memory of 708 4964 explorer.exe 110 PID 4964 wrote to memory of 708 4964 explorer.exe 110 PID 4964 wrote to memory of 708 4964 explorer.exe 110 PID 4964 wrote to memory of 3560 4964 explorer.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1312
-
-
C:\Users\Admin\AppData\Local\Temp\00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00d862e519b028c60745a7d6fe126427_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4716 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1120 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3096
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2084 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5036
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3120 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3016
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2544 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1900
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3260 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3508
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2988 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:220 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4080
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2828 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:548
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5048 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1888
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4092
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4404 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4972
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2688
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3536
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3248 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2260 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2620
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4632 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1804
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4344 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4928
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:648
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3516 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:848 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3272
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4528
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4380 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1896 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4328 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2736 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:724
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4576 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3504
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4572 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3860
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1264 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4748
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1600 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3868 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2460 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2264
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2584 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:964
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3468
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1508 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2292
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2920
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:2796 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4620
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4792
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4308 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2272
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4884
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:936 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:436
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4628 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2444
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3804
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4264
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2824
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3952 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1932
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4976
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4272 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1416
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4480
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1420
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:876
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4820 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4396
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3788
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1176 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1528
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2204 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3252
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4416 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3904
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1160 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1684
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2528
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3828 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1472
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:2208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:392
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2884 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2024
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5060
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2940
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4988
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4500
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3648
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3900
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2668
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5088
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:460
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3100
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2008
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2716
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3464
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1100
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5056
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3888
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1388
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4568
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5dceed19d34af5db4968c0b551d97aaef
SHA1d09c4387b9eed1ca4cb55348f7e55a0144d12e04
SHA256821e93b93129de9b17b535c591f5ba41fd6066c654c3be42b86495be422a88f5
SHA512eec619a26aaf1e24e8014a8dac6e60cc4d8a70db6116570c6def3cde5645d27542a06ede29e3842b6a66e607ff12d88e2b4725d068d3e0acb805ff7f264e3d39
-
Filesize
2.2MB
MD5e91f7f62182eb0999340954df2d69330
SHA12e586d20538ce6ed197c45b64d7e14ccc32946eb
SHA256d6d2c7a74f5014d44ef2cc0199e46a6dbb97915b476299ad741a9e9c11415324
SHA512a2d1eae8a8aad53a691f4074d5bbaa6f53c83cbc55b25f0b50b80b20683cf33685993643dd9309f474fd76e92147092cf29b0fb02f121e47c45b68787135878c