Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 16:07
Behavioral task
behavioral1
Sample
b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b4636b1343e40f8211c521b2ef1fe2eb
-
SHA1
21adaa07ec36ec6fa40aed7eaf394bc27b919d5f
-
SHA256
606230928ba3855f8dd214943123bc1071778b033a3ad4b158f41a122ef80414
-
SHA512
7ca016eaea7c0376cc2931928f44f259d54628d9f6af639386b378fd952e0e186b393765f5a106fee04eaf7382becaf08587d64e0a8f2adc8de7b0927981a89d
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZQ:0UzeyQMS4DqodCnoe+iitjWwwk
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3764 explorer.exe 3144 explorer.exe 512 spoolsv.exe 464 spoolsv.exe 1268 spoolsv.exe 2304 spoolsv.exe 3320 spoolsv.exe 4024 spoolsv.exe 2912 spoolsv.exe 4952 spoolsv.exe 4408 spoolsv.exe 4656 spoolsv.exe 1928 spoolsv.exe 3152 spoolsv.exe 2552 spoolsv.exe 1512 spoolsv.exe 1160 spoolsv.exe 3756 spoolsv.exe 2660 spoolsv.exe 4268 spoolsv.exe 1708 spoolsv.exe 3188 spoolsv.exe 3336 spoolsv.exe 4308 spoolsv.exe 1004 spoolsv.exe 2568 spoolsv.exe 928 spoolsv.exe 396 spoolsv.exe 1240 spoolsv.exe 4092 spoolsv.exe 4164 spoolsv.exe 1644 spoolsv.exe 3512 spoolsv.exe 740 explorer.exe 5052 spoolsv.exe 4768 spoolsv.exe 1436 spoolsv.exe 3984 spoolsv.exe 4580 spoolsv.exe 2216 spoolsv.exe 1716 explorer.exe 3872 spoolsv.exe 3352 spoolsv.exe 3600 spoolsv.exe 3972 spoolsv.exe 4840 spoolsv.exe 3792 spoolsv.exe 1204 spoolsv.exe 3628 explorer.exe 756 spoolsv.exe 4600 spoolsv.exe 1432 spoolsv.exe 4388 spoolsv.exe 5080 spoolsv.exe 2068 explorer.exe 4792 spoolsv.exe 2564 spoolsv.exe 1776 spoolsv.exe 4772 spoolsv.exe 1072 spoolsv.exe 2680 explorer.exe 956 spoolsv.exe 1232 spoolsv.exe 4936 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 56 IoCs
description pid Process procid_target PID 1240 set thread context of 1596 1240 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 87 PID 3764 set thread context of 3144 3764 explorer.exe 96 PID 512 set thread context of 3512 512 spoolsv.exe 127 PID 464 set thread context of 5052 464 spoolsv.exe 129 PID 1268 set thread context of 4768 1268 spoolsv.exe 130 PID 2304 set thread context of 1436 2304 spoolsv.exe 131 PID 3320 set thread context of 4580 3320 spoolsv.exe 133 PID 4024 set thread context of 2216 4024 spoolsv.exe 134 PID 2912 set thread context of 3872 2912 spoolsv.exe 136 PID 4952 set thread context of 3352 4952 spoolsv.exe 137 PID 4408 set thread context of 3600 4408 spoolsv.exe 138 PID 4656 set thread context of 3972 4656 spoolsv.exe 139 PID 1928 set thread context of 3792 1928 spoolsv.exe 141 PID 3152 set thread context of 1204 3152 spoolsv.exe 142 PID 2552 set thread context of 756 2552 spoolsv.exe 144 PID 1512 set thread context of 4600 1512 spoolsv.exe 145 PID 1160 set thread context of 4388 1160 spoolsv.exe 147 PID 3756 set thread context of 5080 3756 spoolsv.exe 148 PID 2660 set thread context of 4792 2660 spoolsv.exe 150 PID 4268 set thread context of 2564 4268 spoolsv.exe 151 PID 1708 set thread context of 1776 1708 spoolsv.exe 152 PID 3188 set thread context of 1072 3188 spoolsv.exe 154 PID 3336 set thread context of 956 3336 spoolsv.exe 156 PID 4308 set thread context of 1232 4308 spoolsv.exe 157 PID 1004 set thread context of 4936 1004 spoolsv.exe 158 PID 2568 set thread context of 908 2568 spoolsv.exe 161 PID 928 set thread context of 2804 928 spoolsv.exe 162 PID 396 set thread context of 768 396 spoolsv.exe 163 PID 1240 set thread context of 432 1240 spoolsv.exe 164 PID 4092 set thread context of 4468 4092 spoolsv.exe 167 PID 4164 set thread context of 5076 4164 spoolsv.exe 169 PID 1644 set thread context of 2528 1644 spoolsv.exe 173 PID 740 set thread context of 4788 740 explorer.exe 175 PID 3984 set thread context of 4396 3984 spoolsv.exe 179 PID 1716 set thread context of 5112 1716 explorer.exe 182 PID 4840 set thread context of 4780 4840 spoolsv.exe 184 PID 3628 set thread context of 2224 3628 explorer.exe 187 PID 2068 set thread context of 3472 2068 explorer.exe 190 PID 1432 set thread context of 1312 1432 spoolsv.exe 191 PID 2680 set thread context of 4584 2680 explorer.exe 195 PID 4772 set thread context of 404 4772 spoolsv.exe 196 PID 4292 set thread context of 2236 4292 explorer.exe 200 PID 3172 set thread context of 2372 3172 spoolsv.exe 202 PID 264 set thread context of 2676 264 spoolsv.exe 204 PID 2040 set thread context of 2104 2040 explorer.exe 206 PID 3180 set thread context of 976 3180 spoolsv.exe 207 PID 1748 set thread context of 2324 1748 spoolsv.exe 208 PID 3020 set thread context of 3216 3020 spoolsv.exe 210 PID 1752 set thread context of 2904 1752 spoolsv.exe 213 PID 116 set thread context of 3676 116 explorer.exe 215 PID 3228 set thread context of 4168 3228 spoolsv.exe 216 PID 3208 set thread context of 412 3208 spoolsv.exe 217 PID 224 set thread context of 4480 224 spoolsv.exe 219 PID 4376 set thread context of 320 4376 spoolsv.exe 221 PID 1736 set thread context of 1508 1736 explorer.exe 222 PID 4548 set thread context of 212 4548 spoolsv.exe 224 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1596 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 1596 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3144 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1596 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 1596 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3144 explorer.exe 3512 spoolsv.exe 3512 spoolsv.exe 5052 spoolsv.exe 5052 spoolsv.exe 4768 spoolsv.exe 4768 spoolsv.exe 1436 spoolsv.exe 1436 spoolsv.exe 4580 spoolsv.exe 4580 spoolsv.exe 2216 spoolsv.exe 2216 spoolsv.exe 3872 spoolsv.exe 3872 spoolsv.exe 3352 spoolsv.exe 3352 spoolsv.exe 3600 spoolsv.exe 3600 spoolsv.exe 3972 spoolsv.exe 3972 spoolsv.exe 3792 spoolsv.exe 3792 spoolsv.exe 1204 spoolsv.exe 1204 spoolsv.exe 756 spoolsv.exe 756 spoolsv.exe 4600 spoolsv.exe 4600 spoolsv.exe 4388 spoolsv.exe 4388 spoolsv.exe 5080 spoolsv.exe 5080 spoolsv.exe 4792 spoolsv.exe 4792 spoolsv.exe 2564 spoolsv.exe 2564 spoolsv.exe 1776 spoolsv.exe 1776 spoolsv.exe 1072 spoolsv.exe 1072 spoolsv.exe 956 spoolsv.exe 956 spoolsv.exe 1232 spoolsv.exe 1232 spoolsv.exe 4936 spoolsv.exe 4936 spoolsv.exe 908 spoolsv.exe 908 spoolsv.exe 2804 spoolsv.exe 2804 spoolsv.exe 768 spoolsv.exe 768 spoolsv.exe 432 spoolsv.exe 432 spoolsv.exe 4468 spoolsv.exe 4468 spoolsv.exe 5076 spoolsv.exe 5076 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1240 wrote to memory of 1412 1240 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 82 PID 1240 wrote to memory of 1412 1240 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 82 PID 1240 wrote to memory of 1596 1240 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 87 PID 1240 wrote to memory of 1596 1240 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 87 PID 1240 wrote to memory of 1596 1240 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 87 PID 1240 wrote to memory of 1596 1240 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 87 PID 1240 wrote to memory of 1596 1240 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 87 PID 1596 wrote to memory of 3764 1596 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 88 PID 1596 wrote to memory of 3764 1596 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 88 PID 1596 wrote to memory of 3764 1596 b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe 88 PID 3764 wrote to memory of 3144 3764 explorer.exe 96 PID 3764 wrote to memory of 3144 3764 explorer.exe 96 PID 3764 wrote to memory of 3144 3764 explorer.exe 96 PID 3764 wrote to memory of 3144 3764 explorer.exe 96 PID 3764 wrote to memory of 3144 3764 explorer.exe 96 PID 3144 wrote to memory of 512 3144 explorer.exe 97 PID 3144 wrote to memory of 512 3144 explorer.exe 97 PID 3144 wrote to memory of 512 3144 explorer.exe 97 PID 3144 wrote to memory of 464 3144 explorer.exe 98 PID 3144 wrote to memory of 464 3144 explorer.exe 98 PID 3144 wrote to memory of 464 3144 explorer.exe 98 PID 3144 wrote to memory of 1268 3144 explorer.exe 99 PID 3144 wrote to memory of 1268 3144 explorer.exe 99 PID 3144 wrote to memory of 1268 3144 explorer.exe 99 PID 3144 wrote to memory of 2304 3144 explorer.exe 100 PID 3144 wrote to memory of 2304 3144 explorer.exe 100 PID 3144 wrote to memory of 2304 3144 explorer.exe 100 PID 3144 wrote to memory of 3320 3144 explorer.exe 101 PID 3144 wrote to memory of 3320 3144 explorer.exe 101 PID 3144 wrote to memory of 3320 3144 explorer.exe 101 PID 3144 wrote to memory of 4024 3144 explorer.exe 102 PID 3144 wrote to memory of 4024 3144 explorer.exe 102 PID 3144 wrote to memory of 4024 3144 explorer.exe 102 PID 3144 wrote to memory of 2912 3144 explorer.exe 103 PID 3144 wrote to memory of 2912 3144 explorer.exe 103 PID 3144 wrote to memory of 2912 3144 explorer.exe 103 PID 3144 wrote to memory of 4952 3144 explorer.exe 104 PID 3144 wrote to memory of 4952 3144 explorer.exe 104 PID 3144 wrote to memory of 4952 3144 explorer.exe 104 PID 3144 wrote to memory of 4408 3144 explorer.exe 105 PID 3144 wrote to memory of 4408 3144 explorer.exe 105 PID 3144 wrote to memory of 4408 3144 explorer.exe 105 PID 3144 wrote to memory of 4656 3144 explorer.exe 106 PID 3144 wrote to memory of 4656 3144 explorer.exe 106 PID 3144 wrote to memory of 4656 3144 explorer.exe 106 PID 3144 wrote to memory of 1928 3144 explorer.exe 107 PID 3144 wrote to memory of 1928 3144 explorer.exe 107 PID 3144 wrote to memory of 1928 3144 explorer.exe 107 PID 3144 wrote to memory of 3152 3144 explorer.exe 108 PID 3144 wrote to memory of 3152 3144 explorer.exe 108 PID 3144 wrote to memory of 3152 3144 explorer.exe 108 PID 3144 wrote to memory of 2552 3144 explorer.exe 109 PID 3144 wrote to memory of 2552 3144 explorer.exe 109 PID 3144 wrote to memory of 2552 3144 explorer.exe 109 PID 3144 wrote to memory of 1512 3144 explorer.exe 110 PID 3144 wrote to memory of 1512 3144 explorer.exe 110 PID 3144 wrote to memory of 1512 3144 explorer.exe 110 PID 3144 wrote to memory of 1160 3144 explorer.exe 111 PID 3144 wrote to memory of 1160 3144 explorer.exe 111 PID 3144 wrote to memory of 1160 3144 explorer.exe 111 PID 3144 wrote to memory of 3756 3144 explorer.exe 112 PID 3144 wrote to memory of 3756 3144 explorer.exe 112 PID 3144 wrote to memory of 3756 3144 explorer.exe 112 PID 3144 wrote to memory of 2660 3144 explorer.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1412
-
-
C:\Users\Admin\AppData\Local\Temp\b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:512 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3512 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:740 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4788
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5052
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1268 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4768
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2304 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3320 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4580
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4024 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2216 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1716 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5112
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3872
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4952 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3352
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4408 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3600
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4656 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3972
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3792
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3152 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1204 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3628 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2224
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:756
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1512 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4600
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1160 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4388
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5080 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2068 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3472
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4792
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4268 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2564
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1776
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3188 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1072 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2680 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4584
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:956
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4308 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1232
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4936 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4292 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2236
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2568 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:908
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2804
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:768
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1240 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:432 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2040 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2104
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4092 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4468
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4164 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5076
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2528
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:116 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3676
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3984 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4396
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1736 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1508
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4840 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4780
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4608
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1312
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4520
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4772 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:404
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3544
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3172 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2372
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2088
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:264 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2676
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:976
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1748 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2324
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:632
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3216
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2904
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4464
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3228 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4168
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:412
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4480
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3832
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4376 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:320
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:212
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3248
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3768
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4300
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1592
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4732
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2364
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4444
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:552
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2296
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4684
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3548
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3936
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3492
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4616
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3616
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1880
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5544e840de107b74b73a0c0fef47ef367
SHA1b7c33bcb6a9c2eede30698fc0c032a9fc1e652cf
SHA2565f804f6c10b313c7faa3ebac14b89182570d38a14137b3130496cbf23ce54d1a
SHA5123ea92725374a04dd1897375480cb026db3a8f67a41f48d7d7232c520ffb713c5d4325d86f89c5bb976ab0a7ea525308ed2bb254c0af5fa785025f2d0dc07416b
-
Filesize
2.2MB
MD56ef23bcfbc6617c696f443f1de71e50f
SHA1587d2447ec39d18e24d9930a2840c2585e3f5699
SHA2569696c1037384291484c260cf3c90411bcd1f0a2aacadc846f1e26561636082d2
SHA512be8897f7b7da27bf7f0e2850209c35a8e2768da24c39ae84e93e801c70c67b16ba6dd8efdf2fca2e838b29aceca126a64acee439ef6287da1e8d97abd4608068