Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 15:54
Behavioral task
behavioral1
Sample
b45544c358917cadc760d6b922858373_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
b45544c358917cadc760d6b922858373_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b45544c358917cadc760d6b922858373
-
SHA1
762bd5b8878249ed621789bd6bf4cb249870de4c
-
SHA256
50a0bee784b709259ccd205742e605677fa184b39ab4edc0ada0eefd8b276ddc
-
SHA512
85648a695089dc14ed672bca6496f1221b93c8211a7fee1e594ce370ef965bc2c2eddf768a7974182496dd1a1312a8193e725093092c7bc292426d901d546ffb
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ9:0UzeyQMS4DqodCnoe+iitjWwwx
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b45544c358917cadc760d6b922858373_JaffaCakes118.exe b45544c358917cadc760d6b922858373_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b45544c358917cadc760d6b922858373_JaffaCakes118.exe b45544c358917cadc760d6b922858373_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 4116 explorer.exe 1396 explorer.exe 3468 spoolsv.exe 4900 spoolsv.exe 968 spoolsv.exe 1432 spoolsv.exe 4536 spoolsv.exe 452 spoolsv.exe 2544 spoolsv.exe 2380 spoolsv.exe 1552 spoolsv.exe 4796 spoolsv.exe 3856 spoolsv.exe 3200 spoolsv.exe 2596 spoolsv.exe 1208 spoolsv.exe 1264 spoolsv.exe 4636 spoolsv.exe 4640 spoolsv.exe 2420 spoolsv.exe 948 spoolsv.exe 496 spoolsv.exe 4400 spoolsv.exe 2916 spoolsv.exe 3680 spoolsv.exe 868 spoolsv.exe 2736 spoolsv.exe 3604 spoolsv.exe 4552 spoolsv.exe 1800 spoolsv.exe 3172 spoolsv.exe 2740 spoolsv.exe 2156 spoolsv.exe 1672 spoolsv.exe 1404 explorer.exe 4040 spoolsv.exe 5040 spoolsv.exe 1216 spoolsv.exe 1448 spoolsv.exe 1920 spoolsv.exe 924 explorer.exe 1044 spoolsv.exe 1064 spoolsv.exe 4376 spoolsv.exe 4128 spoolsv.exe 264 spoolsv.exe 3024 spoolsv.exe 3272 explorer.exe 1692 spoolsv.exe 4728 spoolsv.exe 1456 spoolsv.exe 1080 spoolsv.exe 4068 spoolsv.exe 2432 explorer.exe 456 spoolsv.exe 4456 spoolsv.exe 4788 spoolsv.exe 3408 spoolsv.exe 1720 spoolsv.exe 3828 spoolsv.exe 3248 explorer.exe 3304 spoolsv.exe 1416 spoolsv.exe 3156 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 58 IoCs
description pid Process procid_target PID 3424 set thread context of 3936 3424 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 87 PID 4116 set thread context of 1396 4116 explorer.exe 96 PID 3468 set thread context of 1672 3468 spoolsv.exe 128 PID 4900 set thread context of 4040 4900 spoolsv.exe 130 PID 968 set thread context of 5040 968 spoolsv.exe 131 PID 1432 set thread context of 1448 1432 spoolsv.exe 133 PID 4536 set thread context of 1920 4536 spoolsv.exe 134 PID 452 set thread context of 1044 452 spoolsv.exe 136 PID 2544 set thread context of 1064 2544 spoolsv.exe 137 PID 2380 set thread context of 4376 2380 spoolsv.exe 138 PID 1552 set thread context of 264 1552 spoolsv.exe 140 PID 4796 set thread context of 3024 4796 spoolsv.exe 141 PID 3856 set thread context of 4728 3856 spoolsv.exe 144 PID 3200 set thread context of 1456 3200 spoolsv.exe 145 PID 2596 set thread context of 1080 2596 spoolsv.exe 146 PID 1208 set thread context of 4068 1208 spoolsv.exe 147 PID 1264 set thread context of 456 1264 spoolsv.exe 149 PID 4636 set thread context of 4788 4636 spoolsv.exe 151 PID 4640 set thread context of 3408 4640 spoolsv.exe 152 PID 2420 set thread context of 1720 2420 spoolsv.exe 153 PID 948 set thread context of 3828 948 spoolsv.exe 154 PID 496 set thread context of 1416 496 spoolsv.exe 157 PID 4400 set thread context of 3156 4400 spoolsv.exe 158 PID 2916 set thread context of 4168 2916 spoolsv.exe 159 PID 3680 set thread context of 2788 3680 spoolsv.exe 160 PID 868 set thread context of 376 868 spoolsv.exe 161 PID 2736 set thread context of 4108 2736 spoolsv.exe 162 PID 3604 set thread context of 4856 3604 spoolsv.exe 164 PID 4552 set thread context of 4100 4552 spoolsv.exe 166 PID 1800 set thread context of 660 1800 spoolsv.exe 167 PID 3172 set thread context of 4408 3172 spoolsv.exe 168 PID 2740 set thread context of 1252 2740 spoolsv.exe 170 PID 2156 set thread context of 940 2156 spoolsv.exe 174 PID 1404 set thread context of 436 1404 explorer.exe 176 PID 1216 set thread context of 3092 1216 spoolsv.exe 180 PID 924 set thread context of 4888 924 explorer.exe 182 PID 4128 set thread context of 3080 4128 spoolsv.exe 184 PID 3272 set thread context of 4236 3272 explorer.exe 188 PID 1692 set thread context of 2016 1692 spoolsv.exe 190 PID 2432 set thread context of 1228 2432 explorer.exe 194 PID 4456 set thread context of 4284 4456 spoolsv.exe 195 PID 3304 set thread context of 396 3304 spoolsv.exe 201 PID 3248 set thread context of 4696 3248 explorer.exe 204 PID 1724 set thread context of 4592 1724 spoolsv.exe 207 PID 1324 set thread context of 1628 1324 explorer.exe 209 PID 556 set thread context of 4084 556 spoolsv.exe 210 PID 2948 set thread context of 1376 2948 explorer.exe 211 PID 3136 set thread context of 2044 3136 spoolsv.exe 212 PID 1744 set thread context of 3296 1744 spoolsv.exe 214 PID 3088 set thread context of 4528 3088 explorer.exe 216 PID 1592 set thread context of 4572 1592 spoolsv.exe 217 PID 2908 set thread context of 4672 2908 spoolsv.exe 218 PID 1688 set thread context of 4480 1688 spoolsv.exe 220 PID 4016 set thread context of 4884 4016 explorer.exe 222 PID 3460 set thread context of 4124 3460 spoolsv.exe 224 PID 1184 set thread context of 1500 1184 explorer.exe 225 PID 3260 set thread context of 180 3260 spoolsv.exe 226 PID 2564 set thread context of 1712 2564 spoolsv.exe 228 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini b45544c358917cadc760d6b922858373_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3936 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 3936 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1396 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3936 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 3936 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1672 spoolsv.exe 1672 spoolsv.exe 4040 spoolsv.exe 4040 spoolsv.exe 5040 spoolsv.exe 5040 spoolsv.exe 1448 spoolsv.exe 1448 spoolsv.exe 1920 spoolsv.exe 1920 spoolsv.exe 1044 spoolsv.exe 1044 spoolsv.exe 1064 spoolsv.exe 1064 spoolsv.exe 4376 spoolsv.exe 4376 spoolsv.exe 264 spoolsv.exe 264 spoolsv.exe 3024 spoolsv.exe 3024 spoolsv.exe 4728 spoolsv.exe 4728 spoolsv.exe 1456 spoolsv.exe 1456 spoolsv.exe 1080 spoolsv.exe 1080 spoolsv.exe 4068 spoolsv.exe 4068 spoolsv.exe 456 spoolsv.exe 456 spoolsv.exe 4788 spoolsv.exe 4788 spoolsv.exe 3408 spoolsv.exe 3408 spoolsv.exe 1720 spoolsv.exe 1720 spoolsv.exe 3828 spoolsv.exe 3828 spoolsv.exe 1416 spoolsv.exe 1416 spoolsv.exe 3156 spoolsv.exe 3156 spoolsv.exe 4168 spoolsv.exe 4168 spoolsv.exe 2788 spoolsv.exe 2788 spoolsv.exe 376 spoolsv.exe 376 spoolsv.exe 4108 spoolsv.exe 4108 spoolsv.exe 4856 spoolsv.exe 4856 spoolsv.exe 4100 spoolsv.exe 4100 spoolsv.exe 660 spoolsv.exe 660 spoolsv.exe 4408 spoolsv.exe 4408 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3424 wrote to memory of 224 3424 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 82 PID 3424 wrote to memory of 224 3424 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 82 PID 3424 wrote to memory of 3936 3424 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 87 PID 3424 wrote to memory of 3936 3424 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 87 PID 3424 wrote to memory of 3936 3424 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 87 PID 3424 wrote to memory of 3936 3424 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 87 PID 3424 wrote to memory of 3936 3424 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 87 PID 3936 wrote to memory of 4116 3936 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 88 PID 3936 wrote to memory of 4116 3936 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 88 PID 3936 wrote to memory of 4116 3936 b45544c358917cadc760d6b922858373_JaffaCakes118.exe 88 PID 4116 wrote to memory of 1396 4116 explorer.exe 96 PID 4116 wrote to memory of 1396 4116 explorer.exe 96 PID 4116 wrote to memory of 1396 4116 explorer.exe 96 PID 4116 wrote to memory of 1396 4116 explorer.exe 96 PID 4116 wrote to memory of 1396 4116 explorer.exe 96 PID 1396 wrote to memory of 3468 1396 explorer.exe 97 PID 1396 wrote to memory of 3468 1396 explorer.exe 97 PID 1396 wrote to memory of 3468 1396 explorer.exe 97 PID 1396 wrote to memory of 4900 1396 explorer.exe 98 PID 1396 wrote to memory of 4900 1396 explorer.exe 98 PID 1396 wrote to memory of 4900 1396 explorer.exe 98 PID 1396 wrote to memory of 968 1396 explorer.exe 99 PID 1396 wrote to memory of 968 1396 explorer.exe 99 PID 1396 wrote to memory of 968 1396 explorer.exe 99 PID 1396 wrote to memory of 1432 1396 explorer.exe 100 PID 1396 wrote to memory of 1432 1396 explorer.exe 100 PID 1396 wrote to memory of 1432 1396 explorer.exe 100 PID 1396 wrote to memory of 4536 1396 explorer.exe 101 PID 1396 wrote to memory of 4536 1396 explorer.exe 101 PID 1396 wrote to memory of 4536 1396 explorer.exe 101 PID 1396 wrote to memory of 452 1396 explorer.exe 102 PID 1396 wrote to memory of 452 1396 explorer.exe 102 PID 1396 wrote to memory of 452 1396 explorer.exe 102 PID 1396 wrote to memory of 2544 1396 explorer.exe 103 PID 1396 wrote to memory of 2544 1396 explorer.exe 103 PID 1396 wrote to memory of 2544 1396 explorer.exe 103 PID 1396 wrote to memory of 2380 1396 explorer.exe 104 PID 1396 wrote to memory of 2380 1396 explorer.exe 104 PID 1396 wrote to memory of 2380 1396 explorer.exe 104 PID 1396 wrote to memory of 1552 1396 explorer.exe 105 PID 1396 wrote to memory of 1552 1396 explorer.exe 105 PID 1396 wrote to memory of 1552 1396 explorer.exe 105 PID 1396 wrote to memory of 4796 1396 explorer.exe 106 PID 1396 wrote to memory of 4796 1396 explorer.exe 106 PID 1396 wrote to memory of 4796 1396 explorer.exe 106 PID 1396 wrote to memory of 3856 1396 explorer.exe 107 PID 1396 wrote to memory of 3856 1396 explorer.exe 107 PID 1396 wrote to memory of 3856 1396 explorer.exe 107 PID 1396 wrote to memory of 3200 1396 explorer.exe 108 PID 1396 wrote to memory of 3200 1396 explorer.exe 108 PID 1396 wrote to memory of 3200 1396 explorer.exe 108 PID 1396 wrote to memory of 2596 1396 explorer.exe 109 PID 1396 wrote to memory of 2596 1396 explorer.exe 109 PID 1396 wrote to memory of 2596 1396 explorer.exe 109 PID 1396 wrote to memory of 1208 1396 explorer.exe 110 PID 1396 wrote to memory of 1208 1396 explorer.exe 110 PID 1396 wrote to memory of 1208 1396 explorer.exe 110 PID 1396 wrote to memory of 1264 1396 explorer.exe 111 PID 1396 wrote to memory of 1264 1396 explorer.exe 111 PID 1396 wrote to memory of 1264 1396 explorer.exe 111 PID 1396 wrote to memory of 4636 1396 explorer.exe 112 PID 1396 wrote to memory of 4636 1396 explorer.exe 112 PID 1396 wrote to memory of 4636 1396 explorer.exe 112 PID 1396 wrote to memory of 4640 1396 explorer.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\b45544c358917cadc760d6b922858373_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b45544c358917cadc760d6b922858373_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:224
-
-
C:\Users\Admin\AppData\Local\Temp\b45544c358917cadc760d6b922858373_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b45544c358917cadc760d6b922858373_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3468 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1672 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1404 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:436
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4040
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5040
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1448
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1920 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:924 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4888
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:452 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1044
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2544 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1064
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2380 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4376
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:264
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3024 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3272 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4236
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4728
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1080
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4068 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2432 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1228
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1264 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:456
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4788
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3408
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2420 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:948 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3828 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3248 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4696
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1416
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3156
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4168
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2788
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:868 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:376
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2736 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4108
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4856 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:1324 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1628
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4100
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1800 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:660
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3172 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4408
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1252
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2948 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1376
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2156 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:940
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3088 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4528
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3092
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4016 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4884
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4128 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3080
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1184 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1500
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2016
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3688
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4284
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4984
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3304 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:396
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2936
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4592
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1616
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4084
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3136 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2044
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1744 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3296
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4104
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1592 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4572
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:2908 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4672
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:1688 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4480
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3328
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3460 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4124
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3260 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:180
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:2564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1712
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4412
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2636
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3552
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2220
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1564
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4188
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3036
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1856
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2396
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3228
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2172
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3612
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4916
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4312
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1624
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5e90ad7e6aa20c81f410decb8faf1dcc6
SHA1a74869493f4f9be6db670c0a764c1ec7e6803666
SHA256742bef9ecebe73f7f42e9e8084793a355021458c8297d814f3a4597332208a94
SHA512b1a9195baa37c2f667c1d173a3a3a4f6f60e8f3379c468badbf4a8302b30306d4e2cbdf26a4938e9858cc8502d359b5ff6b0db3bf971aab7d0feab5d189357fc
-
Filesize
2.2MB
MD5bd5d9ba95b5460eddf08d5a2e5e197e1
SHA112488b7394b125cb63ad368c41b1fc742c36cce3
SHA2565985e898f3baca4e3369b46124e8d744622266c84774ea683646d29d3fb63b2b
SHA512251ddc0fd613aab9bc24adfee86268c0eff8a99f91f5e21a27accafd8393785ae0f113f4800e4ad1b7d3a38dbb6bb60d0bff4eb898386ab37f2cf5271a365e33