Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 18:54
Behavioral task
behavioral1
Sample
b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b4add6ab44cf25dc3a8cd318a8a5dbbe
-
SHA1
9102ecc87e7217930df168120268ae8ac2a9248c
-
SHA256
462e19b798cd2298349b7ffda58cc99f7a3efa7e7fe0773d1a29570d8729fe7b
-
SHA512
23a48332435ffa1d503a4e7ce2e78154de4120f9f88bc9bd3d0eb556c5ad22d3e56f47829b54d0f5b461dd4ff495d0c513afcd2a3e9f34de83bae1878e10e7a0
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ5:0UzeyQMS4DqodCnoe+iitjWwwV
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3840 explorer.exe 2980 explorer.exe 4432 spoolsv.exe 1796 spoolsv.exe 1396 spoolsv.exe 4688 spoolsv.exe 3064 spoolsv.exe 2820 spoolsv.exe 3672 spoolsv.exe 3212 spoolsv.exe 1576 spoolsv.exe 3216 spoolsv.exe 2536 spoolsv.exe 1892 spoolsv.exe 4220 spoolsv.exe 1548 spoolsv.exe 2020 spoolsv.exe 3360 spoolsv.exe 1740 spoolsv.exe 1716 spoolsv.exe 3660 spoolsv.exe 116 spoolsv.exe 3116 spoolsv.exe 1916 spoolsv.exe 4176 spoolsv.exe 2200 spoolsv.exe 2036 spoolsv.exe 4864 spoolsv.exe 3180 spoolsv.exe 4332 spoolsv.exe 4988 spoolsv.exe 3004 spoolsv.exe 5040 spoolsv.exe 2148 explorer.exe 2072 spoolsv.exe 2704 spoolsv.exe 4444 spoolsv.exe 244 spoolsv.exe 3636 spoolsv.exe 5016 spoolsv.exe 648 spoolsv.exe 4360 explorer.exe 4680 spoolsv.exe 2792 spoolsv.exe 2196 spoolsv.exe 4804 spoolsv.exe 3432 spoolsv.exe 3200 spoolsv.exe 1696 spoolsv.exe 3408 explorer.exe 4596 spoolsv.exe 4132 spoolsv.exe 3804 spoolsv.exe 4440 spoolsv.exe 2884 spoolsv.exe 636 spoolsv.exe 2040 explorer.exe 4476 spoolsv.exe 3232 spoolsv.exe 4608 spoolsv.exe 3224 spoolsv.exe 3548 spoolsv.exe 736 explorer.exe 1600 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 58 IoCs
description pid Process procid_target PID 4852 set thread context of 1876 4852 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 87 PID 3840 set thread context of 2980 3840 explorer.exe 96 PID 4432 set thread context of 5040 4432 spoolsv.exe 127 PID 1796 set thread context of 2072 1796 spoolsv.exe 129 PID 1396 set thread context of 2704 1396 spoolsv.exe 130 PID 4688 set thread context of 244 4688 spoolsv.exe 132 PID 3064 set thread context of 3636 3064 spoolsv.exe 133 PID 2820 set thread context of 5016 2820 spoolsv.exe 134 PID 3672 set thread context of 648 3672 spoolsv.exe 135 PID 3212 set thread context of 4680 3212 spoolsv.exe 137 PID 1576 set thread context of 2196 1576 spoolsv.exe 139 PID 3216 set thread context of 4804 3216 spoolsv.exe 140 PID 2536 set thread context of 3432 2536 spoolsv.exe 141 PID 1892 set thread context of 1696 1892 spoolsv.exe 143 PID 4220 set thread context of 4596 4220 spoolsv.exe 145 PID 1548 set thread context of 4132 1548 spoolsv.exe 146 PID 2020 set thread context of 3804 2020 spoolsv.exe 147 PID 3360 set thread context of 4440 3360 spoolsv.exe 148 PID 1740 set thread context of 636 1740 spoolsv.exe 150 PID 1716 set thread context of 4476 1716 spoolsv.exe 152 PID 3660 set thread context of 3232 3660 spoolsv.exe 153 PID 116 set thread context of 4608 116 spoolsv.exe 154 PID 3116 set thread context of 3548 3116 spoolsv.exe 156 PID 1916 set thread context of 1600 1916 spoolsv.exe 158 PID 4176 set thread context of 4232 4176 spoolsv.exe 159 PID 2200 set thread context of 3000 2200 spoolsv.exe 160 PID 2036 set thread context of 3412 2036 spoolsv.exe 161 PID 4864 set thread context of 1572 4864 spoolsv.exe 163 PID 3180 set thread context of 3276 3180 spoolsv.exe 164 PID 4332 set thread context of 4552 4332 spoolsv.exe 166 PID 4988 set thread context of 3384 4988 spoolsv.exe 168 PID 3004 set thread context of 4452 3004 spoolsv.exe 172 PID 2148 set thread context of 5080 2148 explorer.exe 176 PID 4444 set thread context of 4684 4444 spoolsv.exe 178 PID 4360 set thread context of 4252 4360 explorer.exe 182 PID 2792 set thread context of 5072 2792 spoolsv.exe 183 PID 3200 set thread context of 4108 3200 spoolsv.exe 188 PID 3408 set thread context of 3520 3408 explorer.exe 190 PID 2040 set thread context of 1588 2040 explorer.exe 193 PID 2884 set thread context of 2380 2884 spoolsv.exe 194 PID 3224 set thread context of 4112 3224 spoolsv.exe 200 PID 736 set thread context of 4060 736 explorer.exe 202 PID 3164 set thread context of 3980 3164 spoolsv.exe 204 PID 4348 set thread context of 4612 4348 explorer.exe 206 PID 4412 set thread context of 1984 4412 spoolsv.exe 207 PID 4216 set thread context of 3756 4216 explorer.exe 208 PID 368 set thread context of 728 368 spoolsv.exe 210 PID 4308 set thread context of 4900 4308 spoolsv.exe 211 PID 2268 set thread context of 2872 2268 explorer.exe 212 PID 2444 set thread context of 2192 2444 spoolsv.exe 213 PID 4624 set thread context of 4016 4624 spoolsv.exe 215 PID 868 set thread context of 1704 868 spoolsv.exe 218 PID 3112 set thread context of 4928 3112 explorer.exe 219 PID 1408 set thread context of 2800 1408 spoolsv.exe 220 PID 3928 set thread context of 180 3928 spoolsv.exe 222 PID 552 set thread context of 4128 552 explorer.exe 223 PID 1216 set thread context of 4448 1216 spoolsv.exe 225 PID 1184 set thread context of 3032 1184 spoolsv.exe 227 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1876 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 1876 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2980 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1876 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 1876 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 5040 spoolsv.exe 5040 spoolsv.exe 2072 spoolsv.exe 2072 spoolsv.exe 2704 spoolsv.exe 2704 spoolsv.exe 244 spoolsv.exe 244 spoolsv.exe 3636 spoolsv.exe 3636 spoolsv.exe 5016 spoolsv.exe 5016 spoolsv.exe 648 spoolsv.exe 648 spoolsv.exe 4680 spoolsv.exe 4680 spoolsv.exe 2196 spoolsv.exe 2196 spoolsv.exe 4804 spoolsv.exe 4804 spoolsv.exe 3432 spoolsv.exe 3432 spoolsv.exe 1696 spoolsv.exe 1696 spoolsv.exe 4596 spoolsv.exe 4596 spoolsv.exe 4132 spoolsv.exe 4132 spoolsv.exe 3804 spoolsv.exe 3804 spoolsv.exe 4440 spoolsv.exe 4440 spoolsv.exe 636 spoolsv.exe 636 spoolsv.exe 4476 spoolsv.exe 4476 spoolsv.exe 3232 spoolsv.exe 3232 spoolsv.exe 4608 spoolsv.exe 4608 spoolsv.exe 3548 spoolsv.exe 3548 spoolsv.exe 1600 spoolsv.exe 1600 spoolsv.exe 4232 spoolsv.exe 4232 spoolsv.exe 3000 spoolsv.exe 3000 spoolsv.exe 3412 spoolsv.exe 3412 spoolsv.exe 1572 spoolsv.exe 1572 spoolsv.exe 3276 spoolsv.exe 3276 spoolsv.exe 4552 spoolsv.exe 4552 spoolsv.exe 3384 spoolsv.exe 3384 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 1188 4852 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 82 PID 4852 wrote to memory of 1188 4852 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 82 PID 4852 wrote to memory of 1876 4852 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 87 PID 4852 wrote to memory of 1876 4852 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 87 PID 4852 wrote to memory of 1876 4852 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 87 PID 4852 wrote to memory of 1876 4852 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 87 PID 4852 wrote to memory of 1876 4852 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3840 1876 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 88 PID 1876 wrote to memory of 3840 1876 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 88 PID 1876 wrote to memory of 3840 1876 b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe 88 PID 3840 wrote to memory of 2980 3840 explorer.exe 96 PID 3840 wrote to memory of 2980 3840 explorer.exe 96 PID 3840 wrote to memory of 2980 3840 explorer.exe 96 PID 3840 wrote to memory of 2980 3840 explorer.exe 96 PID 3840 wrote to memory of 2980 3840 explorer.exe 96 PID 2980 wrote to memory of 4432 2980 explorer.exe 97 PID 2980 wrote to memory of 4432 2980 explorer.exe 97 PID 2980 wrote to memory of 4432 2980 explorer.exe 97 PID 2980 wrote to memory of 1796 2980 explorer.exe 98 PID 2980 wrote to memory of 1796 2980 explorer.exe 98 PID 2980 wrote to memory of 1796 2980 explorer.exe 98 PID 2980 wrote to memory of 1396 2980 explorer.exe 99 PID 2980 wrote to memory of 1396 2980 explorer.exe 99 PID 2980 wrote to memory of 1396 2980 explorer.exe 99 PID 2980 wrote to memory of 4688 2980 explorer.exe 100 PID 2980 wrote to memory of 4688 2980 explorer.exe 100 PID 2980 wrote to memory of 4688 2980 explorer.exe 100 PID 2980 wrote to memory of 3064 2980 explorer.exe 101 PID 2980 wrote to memory of 3064 2980 explorer.exe 101 PID 2980 wrote to memory of 3064 2980 explorer.exe 101 PID 2980 wrote to memory of 2820 2980 explorer.exe 102 PID 2980 wrote to memory of 2820 2980 explorer.exe 102 PID 2980 wrote to memory of 2820 2980 explorer.exe 102 PID 2980 wrote to memory of 3672 2980 explorer.exe 103 PID 2980 wrote to memory of 3672 2980 explorer.exe 103 PID 2980 wrote to memory of 3672 2980 explorer.exe 103 PID 2980 wrote to memory of 3212 2980 explorer.exe 104 PID 2980 wrote to memory of 3212 2980 explorer.exe 104 PID 2980 wrote to memory of 3212 2980 explorer.exe 104 PID 2980 wrote to memory of 1576 2980 explorer.exe 105 PID 2980 wrote to memory of 1576 2980 explorer.exe 105 PID 2980 wrote to memory of 1576 2980 explorer.exe 105 PID 2980 wrote to memory of 3216 2980 explorer.exe 106 PID 2980 wrote to memory of 3216 2980 explorer.exe 106 PID 2980 wrote to memory of 3216 2980 explorer.exe 106 PID 2980 wrote to memory of 2536 2980 explorer.exe 107 PID 2980 wrote to memory of 2536 2980 explorer.exe 107 PID 2980 wrote to memory of 2536 2980 explorer.exe 107 PID 2980 wrote to memory of 1892 2980 explorer.exe 108 PID 2980 wrote to memory of 1892 2980 explorer.exe 108 PID 2980 wrote to memory of 1892 2980 explorer.exe 108 PID 2980 wrote to memory of 4220 2980 explorer.exe 109 PID 2980 wrote to memory of 4220 2980 explorer.exe 109 PID 2980 wrote to memory of 4220 2980 explorer.exe 109 PID 2980 wrote to memory of 1548 2980 explorer.exe 110 PID 2980 wrote to memory of 1548 2980 explorer.exe 110 PID 2980 wrote to memory of 1548 2980 explorer.exe 110 PID 2980 wrote to memory of 2020 2980 explorer.exe 111 PID 2980 wrote to memory of 2020 2980 explorer.exe 111 PID 2980 wrote to memory of 2020 2980 explorer.exe 111 PID 2980 wrote to memory of 3360 2980 explorer.exe 112 PID 2980 wrote to memory of 3360 2980 explorer.exe 112 PID 2980 wrote to memory of 3360 2980 explorer.exe 112 PID 2980 wrote to memory of 1740 2980 explorer.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1188
-
-
C:\Users\Admin\AppData\Local\Temp\b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4add6ab44cf25dc3a8cd318a8a5dbbe_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5040 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2148 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5080
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2072
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2704
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4688 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:244
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3636
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2820 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5016
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:648 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4360 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4252
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4680
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1576 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2196
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4804
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3432
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1696 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3408 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3520
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4596
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4132
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3804
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3360 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4440
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:636 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2040 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1588
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1716 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4476
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3232
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4608
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3548 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:736 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4060
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1600
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4176 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4232
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3000
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3412
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1572
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3276 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4348 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4612
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4332 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4552
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4988 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3384 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4216 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3756
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4452
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2268 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2872
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4684
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3112 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4928
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5072
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:552 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4128
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4108
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:836
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2884 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2380
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4968
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4112
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1888
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3164 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3980
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3724
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1984
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:368 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:728
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4308 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4900
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:2444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2192
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4016
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1556
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:868 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1704
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1408 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2800
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1976
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:180
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4448
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4388
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1184 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3032
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3136
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4316
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4436
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3536
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:672
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4320
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1856
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2840
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3748
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1472
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:436
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD590c87a4e7d447b1461be52198f7d9a13
SHA16480a17154596740aab0fe24af686bde77a63f70
SHA256a3ecd182d7e3a5f016b111ae40dc6c3533228677b99b2038782374ff569e0f8c
SHA51262ae2aa9a66cdf84f9c9018986c3db48da9979dd2e4dd1ddba6d215ca3078b78f0f7bb3d6141811a3917251eaf14959eaed8707bf887eaaa1d83b9aee13d06db
-
Filesize
2.2MB
MD54318d8344d0cdeaa9cf866b9b078f4c7
SHA1c7d3a979002d1db4599239ee9454c72ddf0bb800
SHA25697f4ec939285ae99b297680f5f3eae99ef28617c781bf9a1d0f280409399d1d2
SHA512955994633871bce3c2f24038233ee7074370dcd488eec94e56c09c04a90361dad5859eabdc8c99699879781acaa2417279ac26e8f9cdb6aa51581dc0b1e51473