Analysis
-
max time kernel
140s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 17:56
Behavioral task
behavioral1
Sample
b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b470ddaed944bf91ccee9310b640460f
-
SHA1
2ff65b94980341de69469e0192cac43b2b02ae98
-
SHA256
0b57df701122e7f9f255061a6340f503285ea7cc623476eb95f0c5d3154de38a
-
SHA512
208fcef72460354b4878322c5d8636c33fc3f316d65900d089d1cd2673bffac220022081c40bbef3eb53d3c304e2e923f4c4b50b72ceb817f967c5fad7ca283b
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwwA
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3192 explorer.exe 4336 explorer.exe 2692 spoolsv.exe 5040 spoolsv.exe 4472 spoolsv.exe 1988 spoolsv.exe 1232 spoolsv.exe 4620 spoolsv.exe 3688 spoolsv.exe 3836 spoolsv.exe 4344 spoolsv.exe 4020 spoolsv.exe 4448 spoolsv.exe 388 spoolsv.exe 1772 spoolsv.exe 3208 spoolsv.exe 3960 spoolsv.exe 2152 spoolsv.exe 2428 spoolsv.exe 1228 spoolsv.exe 3020 spoolsv.exe 2780 spoolsv.exe 3904 spoolsv.exe 1328 spoolsv.exe 5116 spoolsv.exe 408 spoolsv.exe 3392 spoolsv.exe 1512 spoolsv.exe 4788 spoolsv.exe 2924 spoolsv.exe 3924 spoolsv.exe 4212 spoolsv.exe 740 spoolsv.exe 2004 spoolsv.exe 4076 explorer.exe 4184 spoolsv.exe 2800 spoolsv.exe 1164 spoolsv.exe 4084 spoolsv.exe 1884 spoolsv.exe 2968 spoolsv.exe 4544 spoolsv.exe 1012 explorer.exe 1728 spoolsv.exe 1620 spoolsv.exe 752 spoolsv.exe 2880 spoolsv.exe 4016 spoolsv.exe 3712 explorer.exe 1844 spoolsv.exe 1248 spoolsv.exe 4800 spoolsv.exe 116 spoolsv.exe 4768 explorer.exe 4176 spoolsv.exe 3912 spoolsv.exe 436 spoolsv.exe 2324 spoolsv.exe 4828 spoolsv.exe 1632 explorer.exe 2820 spoolsv.exe 64 spoolsv.exe 4040 spoolsv.exe 4556 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 50 IoCs
description pid Process procid_target PID 4912 set thread context of 2224 4912 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 86 PID 3192 set thread context of 4336 3192 explorer.exe 95 PID 2692 set thread context of 2004 2692 spoolsv.exe 127 PID 5040 set thread context of 4184 5040 spoolsv.exe 129 PID 4472 set thread context of 2800 4472 spoolsv.exe 130 PID 1988 set thread context of 1164 1988 spoolsv.exe 131 PID 1232 set thread context of 4084 1232 spoolsv.exe 132 PID 4620 set thread context of 1884 4620 spoolsv.exe 133 PID 3688 set thread context of 4544 3688 spoolsv.exe 135 PID 3836 set thread context of 1728 3836 spoolsv.exe 137 PID 4344 set thread context of 1620 4344 spoolsv.exe 138 PID 4020 set thread context of 2880 4020 spoolsv.exe 140 PID 4448 set thread context of 4016 4448 spoolsv.exe 141 PID 388 set thread context of 1844 388 spoolsv.exe 143 PID 1772 set thread context of 1248 1772 spoolsv.exe 144 PID 3208 set thread context of 116 3208 spoolsv.exe 146 PID 3960 set thread context of 4176 3960 spoolsv.exe 148 PID 2152 set thread context of 3912 2152 spoolsv.exe 149 PID 2428 set thread context of 2324 2428 spoolsv.exe 151 PID 1228 set thread context of 4828 1228 spoolsv.exe 152 PID 3020 set thread context of 2820 3020 spoolsv.exe 154 PID 2780 set thread context of 64 2780 spoolsv.exe 155 PID 3904 set thread context of 4556 3904 spoolsv.exe 157 PID 1328 set thread context of 2488 1328 spoolsv.exe 159 PID 5116 set thread context of 824 5116 spoolsv.exe 160 PID 408 set thread context of 2664 408 spoolsv.exe 162 PID 3392 set thread context of 3308 3392 spoolsv.exe 163 PID 1512 set thread context of 1848 1512 spoolsv.exe 165 PID 4788 set thread context of 552 4788 spoolsv.exe 166 PID 2924 set thread context of 3708 2924 spoolsv.exe 168 PID 3924 set thread context of 812 3924 spoolsv.exe 169 PID 4212 set thread context of 4960 4212 spoolsv.exe 171 PID 740 set thread context of 524 740 spoolsv.exe 176 PID 4076 set thread context of 1948 4076 explorer.exe 178 PID 2968 set thread context of 3180 2968 spoolsv.exe 181 PID 1012 set thread context of 1828 1012 explorer.exe 183 PID 752 set thread context of 1348 752 spoolsv.exe 185 PID 3712 set thread context of 224 3712 explorer.exe 187 PID 4800 set thread context of 4980 4800 spoolsv.exe 190 PID 4768 set thread context of 3472 4768 explorer.exe 192 PID 436 set thread context of 4712 436 spoolsv.exe 195 PID 1632 set thread context of 4744 1632 explorer.exe 197 PID 4040 set thread context of 3980 4040 spoolsv.exe 201 PID 1796 set thread context of 2568 1796 explorer.exe 204 PID 3900 set thread context of 4488 3900 spoolsv.exe 206 PID 3680 set thread context of 1668 3680 explorer.exe 209 PID 4604 set thread context of 1628 4604 spoolsv.exe 210 PID 2276 set thread context of 4316 2276 explorer.exe 211 PID 1268 set thread context of 3044 1268 spoolsv.exe 213 PID 4484 set thread context of 4952 4484 spoolsv.exe 215 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2224 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 2224 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4336 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2224 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 2224 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 4336 explorer.exe 2004 spoolsv.exe 2004 spoolsv.exe 4184 spoolsv.exe 4184 spoolsv.exe 2800 spoolsv.exe 2800 spoolsv.exe 1164 spoolsv.exe 1164 spoolsv.exe 4084 spoolsv.exe 4084 spoolsv.exe 1884 spoolsv.exe 1884 spoolsv.exe 4544 spoolsv.exe 4544 spoolsv.exe 1728 spoolsv.exe 1728 spoolsv.exe 1620 spoolsv.exe 1620 spoolsv.exe 2880 spoolsv.exe 2880 spoolsv.exe 4016 spoolsv.exe 4016 spoolsv.exe 1844 spoolsv.exe 1844 spoolsv.exe 1248 spoolsv.exe 1248 spoolsv.exe 116 spoolsv.exe 116 spoolsv.exe 4176 spoolsv.exe 4176 spoolsv.exe 3912 spoolsv.exe 3912 spoolsv.exe 2324 spoolsv.exe 2324 spoolsv.exe 4828 spoolsv.exe 4828 spoolsv.exe 2820 spoolsv.exe 2820 spoolsv.exe 64 spoolsv.exe 64 spoolsv.exe 4556 spoolsv.exe 4556 spoolsv.exe 2488 spoolsv.exe 2488 spoolsv.exe 824 spoolsv.exe 824 spoolsv.exe 2664 spoolsv.exe 2664 spoolsv.exe 3308 spoolsv.exe 3308 spoolsv.exe 1848 spoolsv.exe 1848 spoolsv.exe 552 spoolsv.exe 552 spoolsv.exe 3708 spoolsv.exe 3708 spoolsv.exe 812 spoolsv.exe 812 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4912 wrote to memory of 3164 4912 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 81 PID 4912 wrote to memory of 3164 4912 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 81 PID 4912 wrote to memory of 2224 4912 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 86 PID 4912 wrote to memory of 2224 4912 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 86 PID 4912 wrote to memory of 2224 4912 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 86 PID 4912 wrote to memory of 2224 4912 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 86 PID 4912 wrote to memory of 2224 4912 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 86 PID 2224 wrote to memory of 3192 2224 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 87 PID 2224 wrote to memory of 3192 2224 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 87 PID 2224 wrote to memory of 3192 2224 b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe 87 PID 3192 wrote to memory of 4336 3192 explorer.exe 95 PID 3192 wrote to memory of 4336 3192 explorer.exe 95 PID 3192 wrote to memory of 4336 3192 explorer.exe 95 PID 3192 wrote to memory of 4336 3192 explorer.exe 95 PID 3192 wrote to memory of 4336 3192 explorer.exe 95 PID 4336 wrote to memory of 2692 4336 explorer.exe 96 PID 4336 wrote to memory of 2692 4336 explorer.exe 96 PID 4336 wrote to memory of 2692 4336 explorer.exe 96 PID 4336 wrote to memory of 5040 4336 explorer.exe 97 PID 4336 wrote to memory of 5040 4336 explorer.exe 97 PID 4336 wrote to memory of 5040 4336 explorer.exe 97 PID 4336 wrote to memory of 4472 4336 explorer.exe 98 PID 4336 wrote to memory of 4472 4336 explorer.exe 98 PID 4336 wrote to memory of 4472 4336 explorer.exe 98 PID 4336 wrote to memory of 1988 4336 explorer.exe 99 PID 4336 wrote to memory of 1988 4336 explorer.exe 99 PID 4336 wrote to memory of 1988 4336 explorer.exe 99 PID 4336 wrote to memory of 1232 4336 explorer.exe 100 PID 4336 wrote to memory of 1232 4336 explorer.exe 100 PID 4336 wrote to memory of 1232 4336 explorer.exe 100 PID 4336 wrote to memory of 4620 4336 explorer.exe 101 PID 4336 wrote to memory of 4620 4336 explorer.exe 101 PID 4336 wrote to memory of 4620 4336 explorer.exe 101 PID 4336 wrote to memory of 3688 4336 explorer.exe 102 PID 4336 wrote to memory of 3688 4336 explorer.exe 102 PID 4336 wrote to memory of 3688 4336 explorer.exe 102 PID 4336 wrote to memory of 3836 4336 explorer.exe 103 PID 4336 wrote to memory of 3836 4336 explorer.exe 103 PID 4336 wrote to memory of 3836 4336 explorer.exe 103 PID 4336 wrote to memory of 4344 4336 explorer.exe 104 PID 4336 wrote to memory of 4344 4336 explorer.exe 104 PID 4336 wrote to memory of 4344 4336 explorer.exe 104 PID 4336 wrote to memory of 4020 4336 explorer.exe 105 PID 4336 wrote to memory of 4020 4336 explorer.exe 105 PID 4336 wrote to memory of 4020 4336 explorer.exe 105 PID 4336 wrote to memory of 4448 4336 explorer.exe 106 PID 4336 wrote to memory of 4448 4336 explorer.exe 106 PID 4336 wrote to memory of 4448 4336 explorer.exe 106 PID 4336 wrote to memory of 388 4336 explorer.exe 107 PID 4336 wrote to memory of 388 4336 explorer.exe 107 PID 4336 wrote to memory of 388 4336 explorer.exe 107 PID 4336 wrote to memory of 1772 4336 explorer.exe 108 PID 4336 wrote to memory of 1772 4336 explorer.exe 108 PID 4336 wrote to memory of 1772 4336 explorer.exe 108 PID 4336 wrote to memory of 3208 4336 explorer.exe 109 PID 4336 wrote to memory of 3208 4336 explorer.exe 109 PID 4336 wrote to memory of 3208 4336 explorer.exe 109 PID 4336 wrote to memory of 3960 4336 explorer.exe 110 PID 4336 wrote to memory of 3960 4336 explorer.exe 110 PID 4336 wrote to memory of 3960 4336 explorer.exe 110 PID 4336 wrote to memory of 2152 4336 explorer.exe 111 PID 4336 wrote to memory of 2152 4336 explorer.exe 111 PID 4336 wrote to memory of 2152 4336 explorer.exe 111 PID 4336 wrote to memory of 2428 4336 explorer.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3164
-
-
C:\Users\Admin\AppData\Local\Temp\b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b470ddaed944bf91ccee9310b640460f_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2004 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4076 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1948
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4184
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2800
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1988 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1164
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1232 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4084
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1884
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3688 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4544 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1012 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1828
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4344 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2880
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4016 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3712 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:224
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1844
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1772 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1248
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:116 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4768 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3472
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4176
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2152 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3912
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2324
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1228 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4828 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1632 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4744
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2820
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2780 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:64
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3904 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4556 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1796 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2568
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1328 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2488
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:824
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:408 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2664
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3308 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:3680 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1668
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1512 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1848
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:552
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2924 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3708
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3924 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:812 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2276 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4316
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4960
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:524
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2432 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4428
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3180
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3800 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1564
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1348
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3444
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4800 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4980
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2304
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4712
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3508
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3980
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4264
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4488
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4720
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1628
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1268 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3044
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1312
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4484 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4952
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3748 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4636
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4592
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4912
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3556
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1320 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2604
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3988
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3576
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4044
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3552
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5072
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4496
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3916
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3496
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3032
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4452
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2128
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1956
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3220
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2824
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4080
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4780
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3200
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2804
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3464
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:424
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4864
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3528
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4692
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3948
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3252
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD53127283c8de9910056de0ed6f19aecdc
SHA19998b31b2ee1736a17339f9fdf20c72c0af3afd5
SHA256e0a5b9a2ae7746252205e4d02d972749a7f3d7c1e12df92031feee77cfed374a
SHA512c21170f376f38a2b7539c1e3a71093c8110e37a3029ad2481c1fa5260bacdee04704699fe397b94fc2c790630fd58e046a51299dd2b66d7ae31a57df0e5c46b5
-
Filesize
2.2MB
MD51a8a94fdf39fb267bb976418d695011b
SHA1310f2555ba57d641fd34ddf3c298cd014c6f8f97
SHA256c826b891588b5f6998fcb005971560d023d74ee46a952997a99bb119d93c5476
SHA512f99723d5e3f822b5c47c754b3db70362f597cd7a254fecd44b476140ff6ed608148ecbe4477cc28e089f7316ffb6fdc113299cd2fdf1493cb3bc3693a9c3c802