Analysis
-
max time kernel
143s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 18:52
Behavioral task
behavioral1
Sample
b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b4ab2fcf8aa81fe076c31d6e8b392c76
-
SHA1
b2440db183b05f70f7101179794bd71c29a6aa7b
-
SHA256
3850b1d3a2c23e1af2159577d39dd80bfd6b7523c3407e4328913d5a8afcb551
-
SHA512
31add694eaa2ebdda6503c51551454da44fa42b8b5ba6ad58bddc4bd319fe66e7b9e5c3e7bddd6cbd4bd53169788c7a656930966389acb0f1e0d94170f3d284e
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwh
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3536 explorer.exe 2404 explorer.exe 4412 spoolsv.exe 2768 spoolsv.exe 3648 spoolsv.exe 4348 spoolsv.exe 4288 spoolsv.exe 4208 spoolsv.exe 3988 spoolsv.exe 4004 spoolsv.exe 4792 spoolsv.exe 2400 spoolsv.exe 2292 spoolsv.exe 3044 spoolsv.exe 4312 spoolsv.exe 1496 spoolsv.exe 4956 spoolsv.exe 3136 spoolsv.exe 3420 spoolsv.exe 528 spoolsv.exe 3548 spoolsv.exe 4132 spoolsv.exe 1104 spoolsv.exe 344 spoolsv.exe 1868 spoolsv.exe 4168 spoolsv.exe 2948 spoolsv.exe 4424 spoolsv.exe 1704 spoolsv.exe 1752 spoolsv.exe 4552 spoolsv.exe 2104 spoolsv.exe 692 spoolsv.exe 740 explorer.exe 1520 spoolsv.exe 380 spoolsv.exe 4500 spoolsv.exe 636 spoolsv.exe 3904 spoolsv.exe 1068 spoolsv.exe 4948 explorer.exe 2836 spoolsv.exe 220 spoolsv.exe 2928 spoolsv.exe 4896 spoolsv.exe 2236 spoolsv.exe 4016 explorer.exe 4820 spoolsv.exe 1992 spoolsv.exe 808 spoolsv.exe 4736 spoolsv.exe 2480 explorer.exe 2016 spoolsv.exe 2904 spoolsv.exe 3440 spoolsv.exe 4856 spoolsv.exe 4904 spoolsv.exe 1236 explorer.exe 1856 spoolsv.exe 2032 spoolsv.exe 1632 spoolsv.exe 4608 spoolsv.exe 4676 spoolsv.exe 1552 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 51 IoCs
description pid Process procid_target PID 5080 set thread context of 1148 5080 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 87 PID 3536 set thread context of 2404 3536 explorer.exe 96 PID 4412 set thread context of 692 4412 spoolsv.exe 127 PID 2768 set thread context of 1520 2768 spoolsv.exe 129 PID 3648 set thread context of 380 3648 spoolsv.exe 130 PID 4348 set thread context of 4500 4348 spoolsv.exe 131 PID 4288 set thread context of 3904 4288 spoolsv.exe 133 PID 4208 set thread context of 1068 4208 spoolsv.exe 134 PID 3988 set thread context of 2836 3988 spoolsv.exe 136 PID 4004 set thread context of 220 4004 spoolsv.exe 137 PID 4792 set thread context of 4896 4792 spoolsv.exe 139 PID 2400 set thread context of 2236 2400 spoolsv.exe 140 PID 2292 set thread context of 4820 2292 spoolsv.exe 142 PID 3044 set thread context of 1992 3044 spoolsv.exe 143 PID 4312 set thread context of 4736 4312 spoolsv.exe 145 PID 1496 set thread context of 2016 1496 spoolsv.exe 147 PID 4956 set thread context of 2904 4956 spoolsv.exe 148 PID 3136 set thread context of 4856 3136 spoolsv.exe 150 PID 3420 set thread context of 4904 3420 spoolsv.exe 151 PID 528 set thread context of 1856 528 spoolsv.exe 153 PID 3548 set thread context of 2032 3548 spoolsv.exe 154 PID 4132 set thread context of 4608 4132 spoolsv.exe 156 PID 1104 set thread context of 4676 1104 spoolsv.exe 157 PID 344 set thread context of 2860 344 spoolsv.exe 159 PID 1868 set thread context of 1112 1868 spoolsv.exe 161 PID 4168 set thread context of 4672 4168 spoolsv.exe 162 PID 2948 set thread context of 1016 2948 spoolsv.exe 163 PID 4424 set thread context of 3224 4424 spoolsv.exe 165 PID 1704 set thread context of 2748 1704 spoolsv.exe 166 PID 1752 set thread context of 5012 1752 spoolsv.exe 168 PID 4552 set thread context of 1880 4552 spoolsv.exe 169 PID 2104 set thread context of 916 2104 spoolsv.exe 174 PID 740 set thread context of 732 740 explorer.exe 177 PID 636 set thread context of 1248 636 spoolsv.exe 179 PID 4948 set thread context of 3376 4948 explorer.exe 182 PID 2928 set thread context of 924 2928 spoolsv.exe 185 PID 4016 set thread context of 5076 4016 explorer.exe 187 PID 808 set thread context of 4144 808 spoolsv.exe 189 PID 2480 set thread context of 2216 2480 explorer.exe 192 PID 3440 set thread context of 1928 3440 spoolsv.exe 195 PID 1236 set thread context of 2516 1236 explorer.exe 197 PID 1632 set thread context of 2356 1632 spoolsv.exe 199 PID 1552 set thread context of 1444 1552 explorer.exe 202 PID 3632 set thread context of 3784 3632 spoolsv.exe 205 PID 1720 set thread context of 4396 1720 explorer.exe 207 PID 2320 set thread context of 4408 2320 spoolsv.exe 208 PID 532 set thread context of 2432 532 explorer.exe 209 PID 3564 set thread context of 2912 3564 spoolsv.exe 211 PID 1732 set thread context of 3796 1732 spoolsv.exe 212 PID 1084 set thread context of 4696 1084 spoolsv.exe 215 PID 4136 set thread context of 1224 4136 explorer.exe 217 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1148 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 1148 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2404 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1148 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 1148 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 692 spoolsv.exe 692 spoolsv.exe 1520 spoolsv.exe 1520 spoolsv.exe 380 spoolsv.exe 380 spoolsv.exe 4500 spoolsv.exe 4500 spoolsv.exe 3904 spoolsv.exe 3904 spoolsv.exe 1068 spoolsv.exe 1068 spoolsv.exe 2836 spoolsv.exe 2836 spoolsv.exe 220 spoolsv.exe 220 spoolsv.exe 4896 spoolsv.exe 4896 spoolsv.exe 2236 spoolsv.exe 2236 spoolsv.exe 4820 spoolsv.exe 4820 spoolsv.exe 1992 spoolsv.exe 1992 spoolsv.exe 4736 spoolsv.exe 4736 spoolsv.exe 2016 spoolsv.exe 2016 spoolsv.exe 2904 spoolsv.exe 2904 spoolsv.exe 4856 spoolsv.exe 4856 spoolsv.exe 4904 spoolsv.exe 4904 spoolsv.exe 1856 spoolsv.exe 1856 spoolsv.exe 2032 spoolsv.exe 2032 spoolsv.exe 4608 spoolsv.exe 4608 spoolsv.exe 4676 spoolsv.exe 4676 spoolsv.exe 2860 spoolsv.exe 2860 spoolsv.exe 1112 spoolsv.exe 1112 spoolsv.exe 4672 spoolsv.exe 4672 spoolsv.exe 1016 spoolsv.exe 1016 spoolsv.exe 3224 spoolsv.exe 3224 spoolsv.exe 2748 spoolsv.exe 2748 spoolsv.exe 5012 spoolsv.exe 5012 spoolsv.exe 1880 spoolsv.exe 1880 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5080 wrote to memory of 1360 5080 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 82 PID 5080 wrote to memory of 1360 5080 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 82 PID 5080 wrote to memory of 1148 5080 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 87 PID 5080 wrote to memory of 1148 5080 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 87 PID 5080 wrote to memory of 1148 5080 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 87 PID 5080 wrote to memory of 1148 5080 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 87 PID 5080 wrote to memory of 1148 5080 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 87 PID 1148 wrote to memory of 3536 1148 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 88 PID 1148 wrote to memory of 3536 1148 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 88 PID 1148 wrote to memory of 3536 1148 b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe 88 PID 3536 wrote to memory of 2404 3536 explorer.exe 96 PID 3536 wrote to memory of 2404 3536 explorer.exe 96 PID 3536 wrote to memory of 2404 3536 explorer.exe 96 PID 3536 wrote to memory of 2404 3536 explorer.exe 96 PID 3536 wrote to memory of 2404 3536 explorer.exe 96 PID 2404 wrote to memory of 4412 2404 explorer.exe 97 PID 2404 wrote to memory of 4412 2404 explorer.exe 97 PID 2404 wrote to memory of 4412 2404 explorer.exe 97 PID 2404 wrote to memory of 2768 2404 explorer.exe 98 PID 2404 wrote to memory of 2768 2404 explorer.exe 98 PID 2404 wrote to memory of 2768 2404 explorer.exe 98 PID 2404 wrote to memory of 3648 2404 explorer.exe 99 PID 2404 wrote to memory of 3648 2404 explorer.exe 99 PID 2404 wrote to memory of 3648 2404 explorer.exe 99 PID 2404 wrote to memory of 4348 2404 explorer.exe 100 PID 2404 wrote to memory of 4348 2404 explorer.exe 100 PID 2404 wrote to memory of 4348 2404 explorer.exe 100 PID 2404 wrote to memory of 4288 2404 explorer.exe 101 PID 2404 wrote to memory of 4288 2404 explorer.exe 101 PID 2404 wrote to memory of 4288 2404 explorer.exe 101 PID 2404 wrote to memory of 4208 2404 explorer.exe 102 PID 2404 wrote to memory of 4208 2404 explorer.exe 102 PID 2404 wrote to memory of 4208 2404 explorer.exe 102 PID 2404 wrote to memory of 3988 2404 explorer.exe 103 PID 2404 wrote to memory of 3988 2404 explorer.exe 103 PID 2404 wrote to memory of 3988 2404 explorer.exe 103 PID 2404 wrote to memory of 4004 2404 explorer.exe 104 PID 2404 wrote to memory of 4004 2404 explorer.exe 104 PID 2404 wrote to memory of 4004 2404 explorer.exe 104 PID 2404 wrote to memory of 4792 2404 explorer.exe 105 PID 2404 wrote to memory of 4792 2404 explorer.exe 105 PID 2404 wrote to memory of 4792 2404 explorer.exe 105 PID 2404 wrote to memory of 2400 2404 explorer.exe 106 PID 2404 wrote to memory of 2400 2404 explorer.exe 106 PID 2404 wrote to memory of 2400 2404 explorer.exe 106 PID 2404 wrote to memory of 2292 2404 explorer.exe 107 PID 2404 wrote to memory of 2292 2404 explorer.exe 107 PID 2404 wrote to memory of 2292 2404 explorer.exe 107 PID 2404 wrote to memory of 3044 2404 explorer.exe 108 PID 2404 wrote to memory of 3044 2404 explorer.exe 108 PID 2404 wrote to memory of 3044 2404 explorer.exe 108 PID 2404 wrote to memory of 4312 2404 explorer.exe 109 PID 2404 wrote to memory of 4312 2404 explorer.exe 109 PID 2404 wrote to memory of 4312 2404 explorer.exe 109 PID 2404 wrote to memory of 1496 2404 explorer.exe 110 PID 2404 wrote to memory of 1496 2404 explorer.exe 110 PID 2404 wrote to memory of 1496 2404 explorer.exe 110 PID 2404 wrote to memory of 4956 2404 explorer.exe 111 PID 2404 wrote to memory of 4956 2404 explorer.exe 111 PID 2404 wrote to memory of 4956 2404 explorer.exe 111 PID 2404 wrote to memory of 3136 2404 explorer.exe 112 PID 2404 wrote to memory of 3136 2404 explorer.exe 112 PID 2404 wrote to memory of 3136 2404 explorer.exe 112 PID 2404 wrote to memory of 3420 2404 explorer.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:692 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:740 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:732
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:380
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4348 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4500
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3904
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1068 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4948 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3376
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3988 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2836
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:220
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4896
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2236 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4016 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5076
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2292 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4820
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1992
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4312 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4736 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2480 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2216
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2904
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3136 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4856
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3420 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4904 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1236 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2516
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:528 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1856
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2032
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4608
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4676 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1552 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1444
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:344 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2860
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1868 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1112
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4168 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4672
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2948 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1016 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1720 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4396
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4424 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3224
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5012
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1880 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:532 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2432
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:916
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4136 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1224
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1248
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1756 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2260
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:924
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4636 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4012
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:808 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4144
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:628
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1928
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:408
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1632 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2356
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2756
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3632 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3784
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1460
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2320 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4408
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2912
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1732 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3796
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3364
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1084 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4696
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4876
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1160 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3972
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2548
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1544 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1576
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4064
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3496
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:180
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1604
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1468
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4568
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4464
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2704
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4000
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2764
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3536
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4236
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1768
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2792
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4392
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3472
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3004
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD577a4dd35d521d6cd0d300c3021a27e12
SHA10a98d9fa4483ecd4427771a6464815034cd71302
SHA2560150d53832b364518698504afc7e5923926fdf0a7b49b7af4c55cf6b0f978840
SHA51287d403aacf8cf03d1d8ed3d6f86c06356c1ecebb526a4d21226ed646e739ebbc7597c6f7cbeee7c06e657f8f8e4761c410e09bb3e5717e33e6bfbd90bc06d7fe
-
Filesize
2.2MB
MD572f39c826556688d8c7d604c8e483cb4
SHA107bab1c60a0cd7c260e9235074a18048cdaec179
SHA2566eacfdf55a43265abf5bfd7da3f169bf468370c946e5cbc365d89398880f8389
SHA512d4bb882e2fc9a4d40fb07c15185d256404c8569446b826713548b8d7322a0ca3acc4c779a00eaeeb94aaf94576213db38b0a29e103b9f4cf377fac3e88a2ac36