Analysis
-
max time kernel
146s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 19:01
Behavioral task
behavioral1
Sample
b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b4b43abcb8b8c8929334e4dc61f8abd4
-
SHA1
43623acb361c632d3f3cc3378991553d4417df5e
-
SHA256
2f56a9b3793e42538c371b31ff0d3bd8c0923bec42fcc2f045195482188cccf8
-
SHA512
5eea88c18204ab7c2c4a454d8f4572f04b7b547b42d68c01c5989a1f3ab244ffe9d92b1d4b56e4f83983fd19b308e0c22d0c5a64a4c82e69c48bd0c0cc90f321
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZY:0UzeyQMS4DqodCnoe+iitjWwwk
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 4340 explorer.exe 3836 explorer.exe 4308 spoolsv.exe 1624 spoolsv.exe 2044 spoolsv.exe 4332 spoolsv.exe 440 spoolsv.exe 3996 spoolsv.exe 4568 spoolsv.exe 4796 spoolsv.exe 3104 spoolsv.exe 3984 spoolsv.exe 1784 spoolsv.exe 2968 spoolsv.exe 840 spoolsv.exe 4868 spoolsv.exe 4792 spoolsv.exe 4088 spoolsv.exe 2620 spoolsv.exe 1456 spoolsv.exe 1836 spoolsv.exe 60 spoolsv.exe 804 spoolsv.exe 1540 spoolsv.exe 2716 spoolsv.exe 2996 spoolsv.exe 4016 spoolsv.exe 3068 spoolsv.exe 1852 spoolsv.exe 872 spoolsv.exe 968 spoolsv.exe 2916 spoolsv.exe 3452 explorer.exe 3124 spoolsv.exe 2972 spoolsv.exe 2560 spoolsv.exe 884 spoolsv.exe 3208 explorer.exe 3920 spoolsv.exe 4080 spoolsv.exe 3356 spoolsv.exe 3704 spoolsv.exe 3204 spoolsv.exe 4908 spoolsv.exe 3372 explorer.exe 4400 spoolsv.exe 1752 spoolsv.exe 1204 spoolsv.exe 1116 spoolsv.exe 4344 explorer.exe 4100 spoolsv.exe 3332 spoolsv.exe 116 spoolsv.exe 3020 spoolsv.exe 4072 spoolsv.exe 2444 spoolsv.exe 2764 spoolsv.exe 1576 explorer.exe 1032 spoolsv.exe 1604 spoolsv.exe 4128 spoolsv.exe 1688 spoolsv.exe 1256 spoolsv.exe 3288 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 53 IoCs
description pid Process procid_target PID 4072 set thread context of 4544 4072 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 87 PID 4340 set thread context of 3836 4340 explorer.exe 96 PID 4308 set thread context of 2916 4308 spoolsv.exe 126 PID 1624 set thread context of 3124 1624 spoolsv.exe 128 PID 2044 set thread context of 2560 2044 spoolsv.exe 130 PID 4332 set thread context of 884 4332 spoolsv.exe 131 PID 440 set thread context of 3920 440 spoolsv.exe 133 PID 3996 set thread context of 4080 3996 spoolsv.exe 134 PID 4568 set thread context of 3356 4568 spoolsv.exe 135 PID 4796 set thread context of 3204 4796 spoolsv.exe 137 PID 3104 set thread context of 4908 3104 spoolsv.exe 138 PID 3984 set thread context of 4400 3984 spoolsv.exe 140 PID 1784 set thread context of 1204 1784 spoolsv.exe 142 PID 2968 set thread context of 1116 2968 spoolsv.exe 143 PID 840 set thread context of 4100 840 spoolsv.exe 145 PID 4868 set thread context of 3332 4868 spoolsv.exe 146 PID 4792 set thread context of 3020 4792 spoolsv.exe 148 PID 4088 set thread context of 4072 4088 spoolsv.exe 149 PID 2620 set thread context of 2444 2620 spoolsv.exe 150 PID 1456 set thread context of 2764 1456 spoolsv.exe 151 PID 1836 set thread context of 1032 1836 spoolsv.exe 153 PID 60 set thread context of 4128 60 spoolsv.exe 155 PID 804 set thread context of 1688 804 spoolsv.exe 156 PID 1540 set thread context of 1256 1540 spoolsv.exe 157 PID 2716 set thread context of 3288 2716 spoolsv.exe 158 PID 2996 set thread context of 3548 2996 spoolsv.exe 161 PID 4016 set thread context of 3028 4016 spoolsv.exe 162 PID 3068 set thread context of 5096 3068 spoolsv.exe 163 PID 1852 set thread context of 4896 1852 spoolsv.exe 164 PID 872 set thread context of 2380 872 spoolsv.exe 167 PID 968 set thread context of 3508 968 spoolsv.exe 169 PID 3452 set thread context of 1228 3452 explorer.exe 172 PID 2972 set thread context of 3340 2972 spoolsv.exe 176 PID 3208 set thread context of 4124 3208 explorer.exe 178 PID 3704 set thread context of 824 3704 spoolsv.exe 181 PID 3372 set thread context of 1800 3372 explorer.exe 183 PID 1752 set thread context of 4240 1752 spoolsv.exe 185 PID 4344 set thread context of 3888 4344 explorer.exe 190 PID 116 set thread context of 1844 116 spoolsv.exe 193 PID 1576 set thread context of 2144 1576 explorer.exe 197 PID 1604 set thread context of 5076 1604 spoolsv.exe 198 PID 2276 set thread context of 4736 2276 explorer.exe 202 PID 4612 set thread context of 3344 4612 spoolsv.exe 203 PID 972 set thread context of 3640 972 explorer.exe 206 PID 4604 set thread context of 1056 4604 spoolsv.exe 207 PID 660 set thread context of 1440 660 spoolsv.exe 209 PID 4356 set thread context of 4176 4356 explorer.exe 211 PID 2452 set thread context of 5004 2452 spoolsv.exe 212 PID 4872 set thread context of 4984 4872 spoolsv.exe 213 PID 712 set thread context of 4476 712 spoolsv.exe 215 PID 3236 set thread context of 2868 3236 spoolsv.exe 218 PID 2104 set thread context of 2748 2104 explorer.exe 220 PID 5040 set thread context of 4732 5040 spoolsv.exe 222 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4544 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 4544 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3836 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4544 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 4544 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 3836 explorer.exe 2916 spoolsv.exe 2916 spoolsv.exe 3124 spoolsv.exe 3124 spoolsv.exe 2560 spoolsv.exe 2560 spoolsv.exe 884 spoolsv.exe 884 spoolsv.exe 3920 spoolsv.exe 3920 spoolsv.exe 4080 spoolsv.exe 4080 spoolsv.exe 3356 spoolsv.exe 3356 spoolsv.exe 3204 spoolsv.exe 3204 spoolsv.exe 4908 spoolsv.exe 4908 spoolsv.exe 4400 spoolsv.exe 4400 spoolsv.exe 1204 spoolsv.exe 1204 spoolsv.exe 1116 spoolsv.exe 1116 spoolsv.exe 4100 spoolsv.exe 4100 spoolsv.exe 3332 spoolsv.exe 3332 spoolsv.exe 3020 spoolsv.exe 3020 spoolsv.exe 4072 spoolsv.exe 4072 spoolsv.exe 2444 spoolsv.exe 2444 spoolsv.exe 2764 spoolsv.exe 2764 spoolsv.exe 1032 spoolsv.exe 1032 spoolsv.exe 4128 spoolsv.exe 4128 spoolsv.exe 1688 spoolsv.exe 1688 spoolsv.exe 1256 spoolsv.exe 1256 spoolsv.exe 3288 spoolsv.exe 3288 spoolsv.exe 3548 spoolsv.exe 3548 spoolsv.exe 3028 spoolsv.exe 3028 spoolsv.exe 5096 spoolsv.exe 5096 spoolsv.exe 4896 spoolsv.exe 4896 spoolsv.exe 2380 spoolsv.exe 2380 spoolsv.exe 3508 spoolsv.exe 3508 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4072 wrote to memory of 3336 4072 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 82 PID 4072 wrote to memory of 3336 4072 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 82 PID 4072 wrote to memory of 4544 4072 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 87 PID 4072 wrote to memory of 4544 4072 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 87 PID 4072 wrote to memory of 4544 4072 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 87 PID 4072 wrote to memory of 4544 4072 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 87 PID 4072 wrote to memory of 4544 4072 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 87 PID 4544 wrote to memory of 4340 4544 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 88 PID 4544 wrote to memory of 4340 4544 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 88 PID 4544 wrote to memory of 4340 4544 b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe 88 PID 4340 wrote to memory of 3836 4340 explorer.exe 96 PID 4340 wrote to memory of 3836 4340 explorer.exe 96 PID 4340 wrote to memory of 3836 4340 explorer.exe 96 PID 4340 wrote to memory of 3836 4340 explorer.exe 96 PID 4340 wrote to memory of 3836 4340 explorer.exe 96 PID 3836 wrote to memory of 4308 3836 explorer.exe 97 PID 3836 wrote to memory of 4308 3836 explorer.exe 97 PID 3836 wrote to memory of 4308 3836 explorer.exe 97 PID 3836 wrote to memory of 1624 3836 explorer.exe 98 PID 3836 wrote to memory of 1624 3836 explorer.exe 98 PID 3836 wrote to memory of 1624 3836 explorer.exe 98 PID 3836 wrote to memory of 2044 3836 explorer.exe 99 PID 3836 wrote to memory of 2044 3836 explorer.exe 99 PID 3836 wrote to memory of 2044 3836 explorer.exe 99 PID 3836 wrote to memory of 4332 3836 explorer.exe 100 PID 3836 wrote to memory of 4332 3836 explorer.exe 100 PID 3836 wrote to memory of 4332 3836 explorer.exe 100 PID 3836 wrote to memory of 440 3836 explorer.exe 101 PID 3836 wrote to memory of 440 3836 explorer.exe 101 PID 3836 wrote to memory of 440 3836 explorer.exe 101 PID 3836 wrote to memory of 3996 3836 explorer.exe 102 PID 3836 wrote to memory of 3996 3836 explorer.exe 102 PID 3836 wrote to memory of 3996 3836 explorer.exe 102 PID 3836 wrote to memory of 4568 3836 explorer.exe 103 PID 3836 wrote to memory of 4568 3836 explorer.exe 103 PID 3836 wrote to memory of 4568 3836 explorer.exe 103 PID 3836 wrote to memory of 4796 3836 explorer.exe 104 PID 3836 wrote to memory of 4796 3836 explorer.exe 104 PID 3836 wrote to memory of 4796 3836 explorer.exe 104 PID 3836 wrote to memory of 3104 3836 explorer.exe 105 PID 3836 wrote to memory of 3104 3836 explorer.exe 105 PID 3836 wrote to memory of 3104 3836 explorer.exe 105 PID 3836 wrote to memory of 3984 3836 explorer.exe 106 PID 3836 wrote to memory of 3984 3836 explorer.exe 106 PID 3836 wrote to memory of 3984 3836 explorer.exe 106 PID 3836 wrote to memory of 1784 3836 explorer.exe 107 PID 3836 wrote to memory of 1784 3836 explorer.exe 107 PID 3836 wrote to memory of 1784 3836 explorer.exe 107 PID 3836 wrote to memory of 2968 3836 explorer.exe 108 PID 3836 wrote to memory of 2968 3836 explorer.exe 108 PID 3836 wrote to memory of 2968 3836 explorer.exe 108 PID 3836 wrote to memory of 840 3836 explorer.exe 109 PID 3836 wrote to memory of 840 3836 explorer.exe 109 PID 3836 wrote to memory of 840 3836 explorer.exe 109 PID 3836 wrote to memory of 4868 3836 explorer.exe 110 PID 3836 wrote to memory of 4868 3836 explorer.exe 110 PID 3836 wrote to memory of 4868 3836 explorer.exe 110 PID 3836 wrote to memory of 4792 3836 explorer.exe 111 PID 3836 wrote to memory of 4792 3836 explorer.exe 111 PID 3836 wrote to memory of 4792 3836 explorer.exe 111 PID 3836 wrote to memory of 4088 3836 explorer.exe 112 PID 3836 wrote to memory of 4088 3836 explorer.exe 112 PID 3836 wrote to memory of 4088 3836 explorer.exe 112 PID 3836 wrote to memory of 2620 3836 explorer.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3336
-
-
C:\Users\Admin\AppData\Local\Temp\b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4b43abcb8b8c8929334e4dc61f8abd4_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4308 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2916 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3452 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1228
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3124
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2560
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4332 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:884 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3208 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4124
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3920
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4080
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4568 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3356
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3204
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4908 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3372 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1800
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3984 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4400
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1204
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1116 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4344 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3888
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:840 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4100
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4868 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3332
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4088 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4072
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2444
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2764 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1576 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2144
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1032
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:60 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4128
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:804 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1688
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1256
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2716 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3288 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2276 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4736
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3548
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3028
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5096
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4896 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:972 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3640
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:872 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2380
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3508 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4356 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4176
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2972 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3340
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2104 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2748
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:824
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2140 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3552
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4240
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1200
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1844
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4776
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5076
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4380
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4612 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3344
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3484
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1056
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1440
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3628
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2452 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5004
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4872 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4984
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:712 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4476
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:540
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3236 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2868
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4848
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4732
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4932
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1908
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:452
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1924
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3880
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:880
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2492
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1036
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1904
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1360
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3624
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:764
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2816
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2364
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1792
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5052
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2684
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4468
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3464
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD568ff0a772dee50a7f7c31dfd34bb12a9
SHA107d29fc05788d5b1ae5507b8533dea163b38459e
SHA256ef618a37afe342db95eea065c497be46b293ba3f5d1b06ef21d232128bfe36f6
SHA51218c76a6a6b3706f720fcfc2cd51bf8a2fb5a75fbd75d8a751c986bf09fe75182ce3ad33c44899b1cde362f1e1403286378f075bd7d00326a1db3e77a1787ef5d
-
Filesize
2.2MB
MD5b34522e3171a99e44a53ebe70f412e9c
SHA1e796d9b61c97a361748ba25aee6726eb7c4cf427
SHA2561f865a62accfc5424483160bf5acc65a43e12c09dd22434da524f8753775f157
SHA512cf511e67a5d22a5b689c2372080f73a947e7c76b2e38143afe5f7e64a930845ffc80a2011cc80be4594b5e96a1d48084ef27de22a253db6606c357120d9fd573