Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 09:32
Behavioral task
behavioral1
Sample
a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a4dcaee985b9dc39abc2fd3326d18a91
-
SHA1
e4d8ed4cad17ccf215420ba82c0e46d5cae4480d
-
SHA256
8b75d27818c5a069c3e2ccbdd8513844b5c6e65f8ba89eacc3c03d61b9a91138
-
SHA512
98fdfca664f3eb19c0c9f7b5168840f5e119e600ab13a52bbdecb6f9800b2a6839274f4be34d7414d9f17b8ae3b69080b490c69321c30b7e0e6fb1c182951049
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZs:0UzeyQMS4DqodCnoe+iitjWwwQ
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 4716 explorer.exe 3648 explorer.exe 3936 spoolsv.exe 5080 spoolsv.exe 3636 spoolsv.exe 3960 spoolsv.exe 1172 spoolsv.exe 1552 spoolsv.exe 5052 spoolsv.exe 4256 spoolsv.exe 3504 spoolsv.exe 4684 spoolsv.exe 776 spoolsv.exe 1760 spoolsv.exe 3144 spoolsv.exe 4952 spoolsv.exe 1200 spoolsv.exe 3588 spoolsv.exe 5100 spoolsv.exe 3216 spoolsv.exe 1064 spoolsv.exe 3116 spoolsv.exe 5004 spoolsv.exe 1680 spoolsv.exe 3032 spoolsv.exe 4368 spoolsv.exe 392 spoolsv.exe 4048 spoolsv.exe 4340 spoolsv.exe 448 spoolsv.exe 4176 spoolsv.exe 2284 spoolsv.exe 4744 spoolsv.exe 604 explorer.exe 2424 spoolsv.exe 3932 spoolsv.exe 4664 spoolsv.exe 1592 spoolsv.exe 3828 explorer.exe 436 spoolsv.exe 2628 spoolsv.exe 2020 spoolsv.exe 2600 spoolsv.exe 4712 spoolsv.exe 4676 explorer.exe 3848 spoolsv.exe 2036 spoolsv.exe 2352 spoolsv.exe 4616 spoolsv.exe 4672 spoolsv.exe 4440 spoolsv.exe 2752 explorer.exe 696 spoolsv.exe 1784 spoolsv.exe 4180 spoolsv.exe 5012 spoolsv.exe 3976 spoolsv.exe 2276 spoolsv.exe 824 explorer.exe 2536 spoolsv.exe 4100 spoolsv.exe 2176 spoolsv.exe 1460 spoolsv.exe 4380 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 55 IoCs
description pid Process procid_target PID 428 set thread context of 4408 428 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 89 PID 4716 set thread context of 3648 4716 explorer.exe 98 PID 3936 set thread context of 4744 3936 spoolsv.exe 129 PID 5080 set thread context of 2424 5080 spoolsv.exe 131 PID 3636 set thread context of 3932 3636 spoolsv.exe 132 PID 3960 set thread context of 1592 3960 spoolsv.exe 134 PID 1172 set thread context of 436 1172 spoolsv.exe 136 PID 1552 set thread context of 2628 1552 spoolsv.exe 137 PID 5052 set thread context of 2020 5052 spoolsv.exe 138 PID 4256 set thread context of 4712 4256 spoolsv.exe 140 PID 3504 set thread context of 3848 3504 spoolsv.exe 142 PID 4684 set thread context of 2036 4684 spoolsv.exe 143 PID 776 set thread context of 2352 776 spoolsv.exe 144 PID 1760 set thread context of 4672 1760 spoolsv.exe 146 PID 3144 set thread context of 4440 3144 spoolsv.exe 147 PID 4952 set thread context of 696 4952 spoolsv.exe 149 PID 1200 set thread context of 1784 1200 spoolsv.exe 150 PID 3588 set thread context of 4180 3588 spoolsv.exe 151 PID 5100 set thread context of 3976 5100 spoolsv.exe 153 PID 3216 set thread context of 2276 3216 spoolsv.exe 154 PID 1064 set thread context of 2536 1064 spoolsv.exe 156 PID 3116 set thread context of 2176 3116 spoolsv.exe 158 PID 5004 set thread context of 1460 5004 spoolsv.exe 159 PID 1680 set thread context of 4380 1680 spoolsv.exe 160 PID 3032 set thread context of 4852 3032 spoolsv.exe 162 PID 4368 set thread context of 664 4368 spoolsv.exe 163 PID 392 set thread context of 4428 392 spoolsv.exe 165 PID 4048 set thread context of 468 4048 spoolsv.exe 166 PID 4340 set thread context of 3928 4340 spoolsv.exe 168 PID 448 set thread context of 4996 448 spoolsv.exe 169 PID 4176 set thread context of 3076 4176 spoolsv.exe 171 PID 604 set thread context of 4612 604 explorer.exe 174 PID 2284 set thread context of 1448 2284 spoolsv.exe 175 PID 4664 set thread context of 2952 4664 spoolsv.exe 180 PID 3828 set thread context of 3612 3828 explorer.exe 182 PID 2600 set thread context of 1492 2600 spoolsv.exe 185 PID 4676 set thread context of 1400 4676 explorer.exe 188 PID 4616 set thread context of 848 4616 spoolsv.exe 190 PID 2752 set thread context of 384 2752 explorer.exe 193 PID 5012 set thread context of 4864 5012 spoolsv.exe 195 PID 824 set thread context of 2632 824 explorer.exe 199 PID 4100 set thread context of 324 4100 spoolsv.exe 202 PID 2932 set thread context of 5116 2932 explorer.exe 204 PID 4696 set thread context of 1644 4696 spoolsv.exe 208 PID 3676 set thread context of 2820 3676 explorer.exe 209 PID 4052 set thread context of 3644 4052 spoolsv.exe 211 PID 4528 set thread context of 1052 4528 explorer.exe 212 PID 4492 set thread context of 3776 4492 spoolsv.exe 214 PID 4212 set thread context of 4808 4212 explorer.exe 216 PID 3880 set thread context of 4748 3880 spoolsv.exe 217 PID 2648 set thread context of 3876 2648 spoolsv.exe 219 PID 4784 set thread context of 2148 4784 spoolsv.exe 221 PID 4524 set thread context of 2460 4524 explorer.exe 222 PID 688 set thread context of 2264 688 spoolsv.exe 224 PID 640 set thread context of 4892 640 spoolsv.exe 227 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4408 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 4408 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3648 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4408 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 4408 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 3648 explorer.exe 4744 spoolsv.exe 4744 spoolsv.exe 2424 spoolsv.exe 2424 spoolsv.exe 3932 spoolsv.exe 3932 spoolsv.exe 1592 spoolsv.exe 1592 spoolsv.exe 436 spoolsv.exe 436 spoolsv.exe 2628 spoolsv.exe 2628 spoolsv.exe 2020 spoolsv.exe 2020 spoolsv.exe 4712 spoolsv.exe 4712 spoolsv.exe 3848 spoolsv.exe 3848 spoolsv.exe 2036 spoolsv.exe 2036 spoolsv.exe 2352 spoolsv.exe 2352 spoolsv.exe 4672 spoolsv.exe 4672 spoolsv.exe 4440 spoolsv.exe 4440 spoolsv.exe 696 spoolsv.exe 696 spoolsv.exe 1784 spoolsv.exe 1784 spoolsv.exe 4180 spoolsv.exe 4180 spoolsv.exe 3976 spoolsv.exe 3976 spoolsv.exe 2276 spoolsv.exe 2276 spoolsv.exe 2536 spoolsv.exe 2536 spoolsv.exe 2176 spoolsv.exe 2176 spoolsv.exe 1460 spoolsv.exe 1460 spoolsv.exe 4380 spoolsv.exe 4380 spoolsv.exe 4852 spoolsv.exe 4852 spoolsv.exe 664 spoolsv.exe 664 spoolsv.exe 4428 spoolsv.exe 4428 spoolsv.exe 468 spoolsv.exe 468 spoolsv.exe 3928 spoolsv.exe 3928 spoolsv.exe 4996 spoolsv.exe 4996 spoolsv.exe 3076 spoolsv.exe 3076 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 428 wrote to memory of 4356 428 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 84 PID 428 wrote to memory of 4356 428 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 84 PID 428 wrote to memory of 4408 428 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 89 PID 428 wrote to memory of 4408 428 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 89 PID 428 wrote to memory of 4408 428 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 89 PID 428 wrote to memory of 4408 428 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 89 PID 428 wrote to memory of 4408 428 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 89 PID 4408 wrote to memory of 4716 4408 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 90 PID 4408 wrote to memory of 4716 4408 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 90 PID 4408 wrote to memory of 4716 4408 a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe 90 PID 4716 wrote to memory of 3648 4716 explorer.exe 98 PID 4716 wrote to memory of 3648 4716 explorer.exe 98 PID 4716 wrote to memory of 3648 4716 explorer.exe 98 PID 4716 wrote to memory of 3648 4716 explorer.exe 98 PID 4716 wrote to memory of 3648 4716 explorer.exe 98 PID 3648 wrote to memory of 3936 3648 explorer.exe 99 PID 3648 wrote to memory of 3936 3648 explorer.exe 99 PID 3648 wrote to memory of 3936 3648 explorer.exe 99 PID 3648 wrote to memory of 5080 3648 explorer.exe 100 PID 3648 wrote to memory of 5080 3648 explorer.exe 100 PID 3648 wrote to memory of 5080 3648 explorer.exe 100 PID 3648 wrote to memory of 3636 3648 explorer.exe 101 PID 3648 wrote to memory of 3636 3648 explorer.exe 101 PID 3648 wrote to memory of 3636 3648 explorer.exe 101 PID 3648 wrote to memory of 3960 3648 explorer.exe 102 PID 3648 wrote to memory of 3960 3648 explorer.exe 102 PID 3648 wrote to memory of 3960 3648 explorer.exe 102 PID 3648 wrote to memory of 1172 3648 explorer.exe 103 PID 3648 wrote to memory of 1172 3648 explorer.exe 103 PID 3648 wrote to memory of 1172 3648 explorer.exe 103 PID 3648 wrote to memory of 1552 3648 explorer.exe 104 PID 3648 wrote to memory of 1552 3648 explorer.exe 104 PID 3648 wrote to memory of 1552 3648 explorer.exe 104 PID 3648 wrote to memory of 5052 3648 explorer.exe 105 PID 3648 wrote to memory of 5052 3648 explorer.exe 105 PID 3648 wrote to memory of 5052 3648 explorer.exe 105 PID 3648 wrote to memory of 4256 3648 explorer.exe 106 PID 3648 wrote to memory of 4256 3648 explorer.exe 106 PID 3648 wrote to memory of 4256 3648 explorer.exe 106 PID 3648 wrote to memory of 3504 3648 explorer.exe 107 PID 3648 wrote to memory of 3504 3648 explorer.exe 107 PID 3648 wrote to memory of 3504 3648 explorer.exe 107 PID 3648 wrote to memory of 4684 3648 explorer.exe 108 PID 3648 wrote to memory of 4684 3648 explorer.exe 108 PID 3648 wrote to memory of 4684 3648 explorer.exe 108 PID 3648 wrote to memory of 776 3648 explorer.exe 109 PID 3648 wrote to memory of 776 3648 explorer.exe 109 PID 3648 wrote to memory of 776 3648 explorer.exe 109 PID 3648 wrote to memory of 1760 3648 explorer.exe 110 PID 3648 wrote to memory of 1760 3648 explorer.exe 110 PID 3648 wrote to memory of 1760 3648 explorer.exe 110 PID 3648 wrote to memory of 3144 3648 explorer.exe 111 PID 3648 wrote to memory of 3144 3648 explorer.exe 111 PID 3648 wrote to memory of 3144 3648 explorer.exe 111 PID 3648 wrote to memory of 4952 3648 explorer.exe 112 PID 3648 wrote to memory of 4952 3648 explorer.exe 112 PID 3648 wrote to memory of 4952 3648 explorer.exe 112 PID 3648 wrote to memory of 1200 3648 explorer.exe 113 PID 3648 wrote to memory of 1200 3648 explorer.exe 113 PID 3648 wrote to memory of 1200 3648 explorer.exe 113 PID 3648 wrote to memory of 3588 3648 explorer.exe 114 PID 3648 wrote to memory of 3588 3648 explorer.exe 114 PID 3648 wrote to memory of 3588 3648 explorer.exe 114 PID 3648 wrote to memory of 5100 3648 explorer.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4356
-
-
C:\Users\Admin\AppData\Local\Temp\a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a4dcaee985b9dc39abc2fd3326d18a91_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4744 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:604 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4612
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2424
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3932
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1592 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3828 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3612
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1172 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:436
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5052 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4256 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4712 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4676 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1400
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3848
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4684 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2036
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2352
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1760 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4672
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3144 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4440 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2752 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:384
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4952 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:696
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1784
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4180
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5100 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3976
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2276 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:824 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2632
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2536
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2176
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4380 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:2932 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5116
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4852
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4368 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:664
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4428
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4048 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:468 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:3676 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2820
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3928
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4996
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4176 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3076 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:4528 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1052
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2284 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1448
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4212 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4808
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4664 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2952
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4524 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2460
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2600 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1492
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2860 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4364
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4616 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:848
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1356
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5012 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4864
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3904
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4100 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:324
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4148
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4696 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1644
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3296
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4052 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3644
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4492 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3776
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1708
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4748
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3876
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3456
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2148
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:688 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2264
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2748
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4892
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4468
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4948
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:928
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4888
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2580
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3480
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4432
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4944
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2268
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4632
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4768
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3540
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:552
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1152
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2060
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD535343a627e7d72f7197fd0c962d71eb1
SHA1318faead1c6af888bff44d9b9e71839b3000fac1
SHA256991022d943958050597d7d362e22666866af931127e0d3ff20d258e59de8581c
SHA51299acd1ea18d5c751ac037c0b4e2d45adf1acf00867e3e137c425dc5a6b8f226b0d697e7b16ada585e40d5a2bc58c2cd9327fe505ebb69d51bf06b1210fcc85c1
-
Filesize
2.2MB
MD5efa00247ba280fe6de6cd1cd2d476020
SHA118572112de7fca611088a2bdf63c733797f82035
SHA256396a1b52235c2ec64816a8a4d0fe61b1f4e936f91f80c254ca5766923407905a
SHA512b4b06a4d8e96214d41ea9df2a81802c5b073bf7d698e0c101668931e55eaf9fb4a0fa098b4cc41f5b53cd75e548e24ed200bee7ec34ca7e5623353c2bf125dfa