Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2024, 22:38
Behavioral task
behavioral1
Sample
b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b0768288f5e7f9045df3b69843ebbc17
-
SHA1
a9812425d043731a56ceb425c985e17226eddb34
-
SHA256
8c7b90efc8259cae06e87aee15a46bb9e0100bca045f088b633999d4a4e94b02
-
SHA512
bb0d56819e05ee622f47cee351840205095b296f30dda284021caed90f08bfda1e02026f925b1a2fe20aae295bdb3b33cee2e2ee2b6b21c693a462d48cfbaf88
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ/:0UzeyQMS4DqodCnoe+iitjWwwb
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 4536 explorer.exe 3008 explorer.exe 1948 spoolsv.exe 3652 spoolsv.exe 2276 spoolsv.exe 3520 spoolsv.exe 768 spoolsv.exe 2644 spoolsv.exe 5068 spoolsv.exe 3292 spoolsv.exe 3940 spoolsv.exe 2588 spoolsv.exe 4560 spoolsv.exe 4176 spoolsv.exe 2172 spoolsv.exe 3616 spoolsv.exe 912 spoolsv.exe 3020 spoolsv.exe 5048 spoolsv.exe 2796 spoolsv.exe 4124 spoolsv.exe 3148 spoolsv.exe 1480 spoolsv.exe 228 spoolsv.exe 4848 spoolsv.exe 3924 spoolsv.exe 2432 spoolsv.exe 1872 spoolsv.exe 4136 spoolsv.exe 3184 spoolsv.exe 5312 spoolsv.exe 5388 spoolsv.exe 5440 explorer.exe 5484 spoolsv.exe 5564 spoolsv.exe 5924 spoolsv.exe 5968 spoolsv.exe 6048 spoolsv.exe 6120 spoolsv.exe 5380 spoolsv.exe 1980 explorer.exe 5504 spoolsv.exe 5532 spoolsv.exe 5892 spoolsv.exe 6024 spoolsv.exe 5244 spoolsv.exe 5196 explorer.exe 5272 spoolsv.exe 2972 spoolsv.exe 5680 spoolsv.exe 5772 spoolsv.exe 3808 spoolsv.exe 6124 explorer.exe 1404 spoolsv.exe 2160 spoolsv.exe 3920 spoolsv.exe 5756 spoolsv.exe 5840 explorer.exe 5724 spoolsv.exe 5752 spoolsv.exe 5996 spoolsv.exe 1108 spoolsv.exe 4508 spoolsv.exe 4288 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 51 IoCs
description pid Process procid_target PID 380 set thread context of 936 380 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 96 PID 4536 set thread context of 3008 4536 explorer.exe 105 PID 1948 set thread context of 5388 1948 spoolsv.exe 135 PID 3652 set thread context of 5484 3652 spoolsv.exe 137 PID 2276 set thread context of 5564 2276 spoolsv.exe 138 PID 3520 set thread context of 5968 3520 spoolsv.exe 140 PID 768 set thread context of 6048 768 spoolsv.exe 141 PID 2644 set thread context of 6120 2644 spoolsv.exe 142 PID 5068 set thread context of 5380 5068 spoolsv.exe 143 PID 3292 set thread context of 5504 3292 spoolsv.exe 145 PID 3940 set thread context of 5532 3940 spoolsv.exe 146 PID 2588 set thread context of 6024 2588 spoolsv.exe 148 PID 4560 set thread context of 5244 4560 spoolsv.exe 149 PID 4176 set thread context of 5272 4176 spoolsv.exe 151 PID 2172 set thread context of 2972 2172 spoolsv.exe 152 PID 3616 set thread context of 5772 3616 spoolsv.exe 154 PID 912 set thread context of 3808 912 spoolsv.exe 155 PID 3020 set thread context of 1404 3020 spoolsv.exe 157 PID 5048 set thread context of 2160 5048 spoolsv.exe 158 PID 2796 set thread context of 5756 2796 spoolsv.exe 160 PID 4124 set thread context of 5724 4124 spoolsv.exe 162 PID 3148 set thread context of 5752 3148 spoolsv.exe 163 PID 1480 set thread context of 5996 1480 spoolsv.exe 164 PID 228 set thread context of 1108 228 spoolsv.exe 165 PID 4848 set thread context of 4508 4848 spoolsv.exe 166 PID 3924 set thread context of 5328 3924 spoolsv.exe 168 PID 2432 set thread context of 5652 2432 spoolsv.exe 170 PID 1872 set thread context of 4596 1872 spoolsv.exe 172 PID 4136 set thread context of 4768 4136 spoolsv.exe 174 PID 3184 set thread context of 1912 3184 spoolsv.exe 175 PID 5312 set thread context of 5260 5312 spoolsv.exe 179 PID 5440 set thread context of 804 5440 explorer.exe 183 PID 5924 set thread context of 3976 5924 spoolsv.exe 187 PID 1980 set thread context of 4276 1980 explorer.exe 190 PID 5892 set thread context of 3304 5892 spoolsv.exe 193 PID 5196 set thread context of 676 5196 explorer.exe 195 PID 5680 set thread context of 5320 5680 spoolsv.exe 198 PID 6124 set thread context of 5364 6124 explorer.exe 200 PID 5840 set thread context of 2880 5840 explorer.exe 205 PID 3920 set thread context of 4300 3920 spoolsv.exe 206 PID 4288 set thread context of 4220 4288 spoolsv.exe 210 PID 5580 set thread context of 5424 5580 explorer.exe 212 PID 3192 set thread context of 2072 3192 spoolsv.exe 214 PID 1280 set thread context of 6064 1280 explorer.exe 217 PID 4356 set thread context of 5604 4356 spoolsv.exe 218 PID 3224 set thread context of 5284 3224 spoolsv.exe 221 PID 3968 set thread context of 4696 3968 spoolsv.exe 222 PID 468 set thread context of 2788 468 explorer.exe 223 PID 3916 set thread context of 4088 3916 spoolsv.exe 224 PID 2248 set thread context of 2220 2248 spoolsv.exe 226 PID 4420 set thread context of 5712 4420 spoolsv.exe 228 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 936 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 936 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3008 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 936 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 936 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 5388 spoolsv.exe 5388 spoolsv.exe 5484 spoolsv.exe 5484 spoolsv.exe 5564 spoolsv.exe 5564 spoolsv.exe 5968 spoolsv.exe 5968 spoolsv.exe 6048 spoolsv.exe 6048 spoolsv.exe 6120 spoolsv.exe 6120 spoolsv.exe 5380 spoolsv.exe 5380 spoolsv.exe 5504 spoolsv.exe 5504 spoolsv.exe 5532 spoolsv.exe 5532 spoolsv.exe 6024 spoolsv.exe 6024 spoolsv.exe 5244 spoolsv.exe 5244 spoolsv.exe 5272 spoolsv.exe 5272 spoolsv.exe 2972 spoolsv.exe 2972 spoolsv.exe 5772 spoolsv.exe 5772 spoolsv.exe 3808 spoolsv.exe 3808 spoolsv.exe 1404 spoolsv.exe 1404 spoolsv.exe 2160 spoolsv.exe 2160 spoolsv.exe 5756 spoolsv.exe 5756 spoolsv.exe 5724 spoolsv.exe 5724 spoolsv.exe 5752 spoolsv.exe 5752 spoolsv.exe 5996 spoolsv.exe 5996 spoolsv.exe 1108 spoolsv.exe 1108 spoolsv.exe 4508 spoolsv.exe 4508 spoolsv.exe 5328 spoolsv.exe 5328 spoolsv.exe 5652 spoolsv.exe 5652 spoolsv.exe 4596 spoolsv.exe 4596 spoolsv.exe 4768 spoolsv.exe 4768 spoolsv.exe 1912 spoolsv.exe 1912 spoolsv.exe 5260 spoolsv.exe 5260 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 380 wrote to memory of 4464 380 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 90 PID 380 wrote to memory of 4464 380 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 90 PID 380 wrote to memory of 936 380 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 96 PID 380 wrote to memory of 936 380 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 96 PID 380 wrote to memory of 936 380 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 96 PID 380 wrote to memory of 936 380 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 96 PID 380 wrote to memory of 936 380 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 96 PID 936 wrote to memory of 4536 936 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 97 PID 936 wrote to memory of 4536 936 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 97 PID 936 wrote to memory of 4536 936 b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe 97 PID 4536 wrote to memory of 3008 4536 explorer.exe 105 PID 4536 wrote to memory of 3008 4536 explorer.exe 105 PID 4536 wrote to memory of 3008 4536 explorer.exe 105 PID 4536 wrote to memory of 3008 4536 explorer.exe 105 PID 4536 wrote to memory of 3008 4536 explorer.exe 105 PID 3008 wrote to memory of 1948 3008 explorer.exe 106 PID 3008 wrote to memory of 1948 3008 explorer.exe 106 PID 3008 wrote to memory of 1948 3008 explorer.exe 106 PID 3008 wrote to memory of 3652 3008 explorer.exe 107 PID 3008 wrote to memory of 3652 3008 explorer.exe 107 PID 3008 wrote to memory of 3652 3008 explorer.exe 107 PID 3008 wrote to memory of 2276 3008 explorer.exe 108 PID 3008 wrote to memory of 2276 3008 explorer.exe 108 PID 3008 wrote to memory of 2276 3008 explorer.exe 108 PID 3008 wrote to memory of 3520 3008 explorer.exe 109 PID 3008 wrote to memory of 3520 3008 explorer.exe 109 PID 3008 wrote to memory of 3520 3008 explorer.exe 109 PID 3008 wrote to memory of 768 3008 explorer.exe 110 PID 3008 wrote to memory of 768 3008 explorer.exe 110 PID 3008 wrote to memory of 768 3008 explorer.exe 110 PID 3008 wrote to memory of 2644 3008 explorer.exe 111 PID 3008 wrote to memory of 2644 3008 explorer.exe 111 PID 3008 wrote to memory of 2644 3008 explorer.exe 111 PID 3008 wrote to memory of 5068 3008 explorer.exe 112 PID 3008 wrote to memory of 5068 3008 explorer.exe 112 PID 3008 wrote to memory of 5068 3008 explorer.exe 112 PID 3008 wrote to memory of 3292 3008 explorer.exe 113 PID 3008 wrote to memory of 3292 3008 explorer.exe 113 PID 3008 wrote to memory of 3292 3008 explorer.exe 113 PID 3008 wrote to memory of 3940 3008 explorer.exe 114 PID 3008 wrote to memory of 3940 3008 explorer.exe 114 PID 3008 wrote to memory of 3940 3008 explorer.exe 114 PID 3008 wrote to memory of 2588 3008 explorer.exe 115 PID 3008 wrote to memory of 2588 3008 explorer.exe 115 PID 3008 wrote to memory of 2588 3008 explorer.exe 115 PID 3008 wrote to memory of 4560 3008 explorer.exe 116 PID 3008 wrote to memory of 4560 3008 explorer.exe 116 PID 3008 wrote to memory of 4560 3008 explorer.exe 116 PID 3008 wrote to memory of 4176 3008 explorer.exe 117 PID 3008 wrote to memory of 4176 3008 explorer.exe 117 PID 3008 wrote to memory of 4176 3008 explorer.exe 117 PID 3008 wrote to memory of 2172 3008 explorer.exe 118 PID 3008 wrote to memory of 2172 3008 explorer.exe 118 PID 3008 wrote to memory of 2172 3008 explorer.exe 118 PID 3008 wrote to memory of 3616 3008 explorer.exe 119 PID 3008 wrote to memory of 3616 3008 explorer.exe 119 PID 3008 wrote to memory of 3616 3008 explorer.exe 119 PID 3008 wrote to memory of 912 3008 explorer.exe 120 PID 3008 wrote to memory of 912 3008 explorer.exe 120 PID 3008 wrote to memory of 912 3008 explorer.exe 120 PID 3008 wrote to memory of 3020 3008 explorer.exe 121 PID 3008 wrote to memory of 3020 3008 explorer.exe 121 PID 3008 wrote to memory of 3020 3008 explorer.exe 121 PID 3008 wrote to memory of 5048 3008 explorer.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4464
-
-
C:\Users\Admin\AppData\Local\Temp\b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b0768288f5e7f9045df3b69843ebbc17_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1948 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5388 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5440 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:804
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5484
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2276 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5564
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5968
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6048
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6120
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5380 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1980 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4276
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3292 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5504
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5532
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6024
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5244 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5196 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:676
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4176 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5272
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2172 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2972
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3616 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5772
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3808 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:6124 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5364
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1404
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5048 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2160
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5756 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5840 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2880
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4124 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5724
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3148 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1480 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5996
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:228 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1108
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4508
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3924 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5328 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5580 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5424
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5652
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1872 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4596 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1280 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:6064
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4136 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4768
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3184 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1912
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5312 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5260 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:468 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2788
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5924 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3976
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:808
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5932
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3304
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1012
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5320
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4268
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4300
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:6056
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4220
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5452
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2072
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:6016
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5604
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5936
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5284
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4696
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4088
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2220
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5460
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4420 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5712
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4952
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5584
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4372
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:884 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3504
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5412
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6084
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:748
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4624
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:464
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5644
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5000
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3468
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5516
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5876
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2044
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3024
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5384
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5744
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1300
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3296
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4868
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4360,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:81⤵PID:5008
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD52e7ded2ca919132b29149c73b4d4e440
SHA1ff3403a808241eec149afdb822e14f1d333c2bb3
SHA2568364c3acf340d7e491e59633769809973bc9307d7a6e5e644cc1b9c88346da83
SHA512e4d23ff38a3a18572dac49907c26601b985bf1cec155944456c5142f484e841107e530e63457c17865853a12af45d296381208edd96cb72d0b8cf317240b836a
-
Filesize
2.2MB
MD525fb52a0d1bf2a564d6db56af9af02bc
SHA19ed83b1178622cbf4296a81fec228dff376578dc
SHA2563f44773552bdfe8137ff30416729ea595896b9845331a431ccf5452cfa45e228
SHA512d01e16542414e6b85bf8dc49edea0ff5e4ade3215a3841f27e3c10c82c6889264894083c429b6e5d164ea798b080cda6a6e9494fa9a1724f1df93ca0e398f2f9