Analysis
-
max time kernel
149s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 19:34
Behavioral task
behavioral1
Sample
b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b4d7796140279c04e2366df7cd8dfa6c
-
SHA1
00df7767a84e1078488c3a0fac9582c5bc7e92eb
-
SHA256
0d1fb88dc9afec0f96aec068750a6a34fa438aad3de8fa88e410de63fa8107bc
-
SHA512
9a66b393fddec28e146e04ccffc2f2bc2b06ec05b97cc22f76ee6128a89cf9b2d84be15b97ccef28a2d9184d889a89c1bc0d00680445c761ade1ea00e9a80e7f
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZf:0UzeyQMS4DqodCnoe+iitjWwwD
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3212 explorer.exe 5100 explorer.exe 3572 spoolsv.exe 1008 spoolsv.exe 2052 spoolsv.exe 3088 spoolsv.exe 2640 spoolsv.exe 2572 spoolsv.exe 3604 spoolsv.exe 2320 spoolsv.exe 4676 spoolsv.exe 4608 spoolsv.exe 2904 spoolsv.exe 4432 spoolsv.exe 3928 spoolsv.exe 1068 spoolsv.exe 3092 spoolsv.exe 1056 spoolsv.exe 920 spoolsv.exe 4072 spoolsv.exe 5040 spoolsv.exe 2444 spoolsv.exe 4776 spoolsv.exe 1616 spoolsv.exe 4948 spoolsv.exe 4456 spoolsv.exe 1076 spoolsv.exe 1816 spoolsv.exe 3668 spoolsv.exe 3048 spoolsv.exe 2620 spoolsv.exe 4640 spoolsv.exe 3888 explorer.exe 3832 spoolsv.exe 2304 spoolsv.exe 1488 spoolsv.exe 5024 spoolsv.exe 4488 spoolsv.exe 4604 explorer.exe 232 spoolsv.exe 3316 spoolsv.exe 4480 spoolsv.exe 2336 spoolsv.exe 3008 spoolsv.exe 1132 spoolsv.exe 5036 explorer.exe 4280 spoolsv.exe 5044 spoolsv.exe 3064 spoolsv.exe 4084 spoolsv.exe 1004 spoolsv.exe 4980 explorer.exe 2208 spoolsv.exe 3044 spoolsv.exe 4960 spoolsv.exe 4020 spoolsv.exe 116 spoolsv.exe 3056 explorer.exe 1884 spoolsv.exe 4208 spoolsv.exe 4908 spoolsv.exe 1880 spoolsv.exe 2652 spoolsv.exe 2116 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 56 IoCs
description pid Process procid_target PID 2812 set thread context of 3096 2812 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 83 PID 3212 set thread context of 5100 3212 explorer.exe 92 PID 3572 set thread context of 4640 3572 spoolsv.exe 122 PID 1008 set thread context of 2304 1008 spoolsv.exe 125 PID 2052 set thread context of 1488 2052 spoolsv.exe 126 PID 3088 set thread context of 5024 3088 spoolsv.exe 127 PID 2640 set thread context of 232 2640 spoolsv.exe 130 PID 2572 set thread context of 3316 2572 spoolsv.exe 131 PID 3604 set thread context of 4480 3604 spoolsv.exe 132 PID 2320 set thread context of 3008 2320 spoolsv.exe 134 PID 4676 set thread context of 1132 4676 spoolsv.exe 135 PID 4608 set thread context of 4280 4608 spoolsv.exe 137 PID 2904 set thread context of 5044 2904 spoolsv.exe 138 PID 4432 set thread context of 4084 4432 spoolsv.exe 140 PID 3928 set thread context of 1004 3928 spoolsv.exe 141 PID 1068 set thread context of 2208 1068 spoolsv.exe 143 PID 3092 set thread context of 3044 3092 spoolsv.exe 144 PID 1056 set thread context of 4020 1056 spoolsv.exe 146 PID 920 set thread context of 116 920 spoolsv.exe 147 PID 4072 set thread context of 1884 4072 spoolsv.exe 149 PID 5040 set thread context of 4908 5040 spoolsv.exe 151 PID 2444 set thread context of 1880 2444 spoolsv.exe 152 PID 4776 set thread context of 2652 4776 spoolsv.exe 153 PID 1616 set thread context of 2116 1616 spoolsv.exe 154 PID 4948 set thread context of 2504 4948 spoolsv.exe 156 PID 4456 set thread context of 4672 4456 spoolsv.exe 158 PID 1076 set thread context of 1204 1076 spoolsv.exe 159 PID 1816 set thread context of 4764 1816 spoolsv.exe 160 PID 3668 set thread context of 4816 3668 spoolsv.exe 161 PID 3048 set thread context of 2912 3048 spoolsv.exe 163 PID 2620 set thread context of 2624 2620 spoolsv.exe 166 PID 3888 set thread context of 4636 3888 explorer.exe 170 PID 3832 set thread context of 1692 3832 spoolsv.exe 171 PID 4488 set thread context of 3636 4488 spoolsv.exe 175 PID 4604 set thread context of 4520 4604 explorer.exe 178 PID 2336 set thread context of 2360 2336 spoolsv.exe 180 PID 5036 set thread context of 376 5036 explorer.exe 182 PID 3064 set thread context of 1112 3064 spoolsv.exe 185 PID 4980 set thread context of 2636 4980 explorer.exe 188 PID 4960 set thread context of 2920 4960 spoolsv.exe 190 PID 3056 set thread context of 4160 3056 explorer.exe 195 PID 4208 set thread context of 4420 4208 spoolsv.exe 197 PID 2264 set thread context of 4964 2264 explorer.exe 201 PID 4484 set thread context of 2180 4484 spoolsv.exe 203 PID 2488 set thread context of 3512 2488 spoolsv.exe 205 PID 2804 set thread context of 884 2804 explorer.exe 206 PID 2040 set thread context of 2836 2040 spoolsv.exe 207 PID 860 set thread context of 1660 860 explorer.exe 208 PID 4692 set thread context of 2664 4692 spoolsv.exe 210 PID 244 set thread context of 3664 244 spoolsv.exe 212 PID 2480 set thread context of 4896 2480 explorer.exe 213 PID 1864 set thread context of 1752 1864 spoolsv.exe 214 PID 5000 set thread context of 2476 5000 spoolsv.exe 216 PID 1576 set thread context of 856 1576 explorer.exe 218 PID 1952 set thread context of 4756 1952 spoolsv.exe 219 PID 1764 set thread context of 3772 1764 spoolsv.exe 222 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3096 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 3096 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5100 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3096 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 3096 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 5100 explorer.exe 4640 spoolsv.exe 4640 spoolsv.exe 2304 spoolsv.exe 2304 spoolsv.exe 1488 spoolsv.exe 1488 spoolsv.exe 5024 spoolsv.exe 5024 spoolsv.exe 232 spoolsv.exe 232 spoolsv.exe 3316 spoolsv.exe 3316 spoolsv.exe 4480 spoolsv.exe 4480 spoolsv.exe 3008 spoolsv.exe 3008 spoolsv.exe 1132 spoolsv.exe 1132 spoolsv.exe 4280 spoolsv.exe 4280 spoolsv.exe 5044 spoolsv.exe 5044 spoolsv.exe 4084 spoolsv.exe 4084 spoolsv.exe 1004 spoolsv.exe 1004 spoolsv.exe 2208 spoolsv.exe 2208 spoolsv.exe 3044 spoolsv.exe 3044 spoolsv.exe 4020 spoolsv.exe 4020 spoolsv.exe 116 spoolsv.exe 116 spoolsv.exe 1884 spoolsv.exe 1884 spoolsv.exe 4908 spoolsv.exe 4908 spoolsv.exe 1880 spoolsv.exe 1880 spoolsv.exe 2652 spoolsv.exe 2652 spoolsv.exe 2116 spoolsv.exe 2116 spoolsv.exe 2504 spoolsv.exe 2504 spoolsv.exe 4672 spoolsv.exe 4672 spoolsv.exe 1204 spoolsv.exe 1204 spoolsv.exe 4764 spoolsv.exe 4764 spoolsv.exe 4816 spoolsv.exe 4816 spoolsv.exe 2912 spoolsv.exe 2912 spoolsv.exe 2624 spoolsv.exe 2624 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2812 wrote to memory of 3660 2812 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 81 PID 2812 wrote to memory of 3660 2812 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 81 PID 2812 wrote to memory of 3096 2812 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 83 PID 2812 wrote to memory of 3096 2812 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 83 PID 2812 wrote to memory of 3096 2812 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 83 PID 2812 wrote to memory of 3096 2812 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 83 PID 2812 wrote to memory of 3096 2812 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 83 PID 3096 wrote to memory of 3212 3096 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 84 PID 3096 wrote to memory of 3212 3096 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 84 PID 3096 wrote to memory of 3212 3096 b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe 84 PID 3212 wrote to memory of 5100 3212 explorer.exe 92 PID 3212 wrote to memory of 5100 3212 explorer.exe 92 PID 3212 wrote to memory of 5100 3212 explorer.exe 92 PID 3212 wrote to memory of 5100 3212 explorer.exe 92 PID 3212 wrote to memory of 5100 3212 explorer.exe 92 PID 5100 wrote to memory of 3572 5100 explorer.exe 93 PID 5100 wrote to memory of 3572 5100 explorer.exe 93 PID 5100 wrote to memory of 3572 5100 explorer.exe 93 PID 5100 wrote to memory of 1008 5100 explorer.exe 94 PID 5100 wrote to memory of 1008 5100 explorer.exe 94 PID 5100 wrote to memory of 1008 5100 explorer.exe 94 PID 5100 wrote to memory of 2052 5100 explorer.exe 95 PID 5100 wrote to memory of 2052 5100 explorer.exe 95 PID 5100 wrote to memory of 2052 5100 explorer.exe 95 PID 5100 wrote to memory of 3088 5100 explorer.exe 96 PID 5100 wrote to memory of 3088 5100 explorer.exe 96 PID 5100 wrote to memory of 3088 5100 explorer.exe 96 PID 5100 wrote to memory of 2640 5100 explorer.exe 97 PID 5100 wrote to memory of 2640 5100 explorer.exe 97 PID 5100 wrote to memory of 2640 5100 explorer.exe 97 PID 5100 wrote to memory of 2572 5100 explorer.exe 98 PID 5100 wrote to memory of 2572 5100 explorer.exe 98 PID 5100 wrote to memory of 2572 5100 explorer.exe 98 PID 5100 wrote to memory of 3604 5100 explorer.exe 99 PID 5100 wrote to memory of 3604 5100 explorer.exe 99 PID 5100 wrote to memory of 3604 5100 explorer.exe 99 PID 5100 wrote to memory of 2320 5100 explorer.exe 100 PID 5100 wrote to memory of 2320 5100 explorer.exe 100 PID 5100 wrote to memory of 2320 5100 explorer.exe 100 PID 5100 wrote to memory of 4676 5100 explorer.exe 101 PID 5100 wrote to memory of 4676 5100 explorer.exe 101 PID 5100 wrote to memory of 4676 5100 explorer.exe 101 PID 5100 wrote to memory of 4608 5100 explorer.exe 102 PID 5100 wrote to memory of 4608 5100 explorer.exe 102 PID 5100 wrote to memory of 4608 5100 explorer.exe 102 PID 5100 wrote to memory of 2904 5100 explorer.exe 103 PID 5100 wrote to memory of 2904 5100 explorer.exe 103 PID 5100 wrote to memory of 2904 5100 explorer.exe 103 PID 5100 wrote to memory of 4432 5100 explorer.exe 104 PID 5100 wrote to memory of 4432 5100 explorer.exe 104 PID 5100 wrote to memory of 4432 5100 explorer.exe 104 PID 5100 wrote to memory of 3928 5100 explorer.exe 105 PID 5100 wrote to memory of 3928 5100 explorer.exe 105 PID 5100 wrote to memory of 3928 5100 explorer.exe 105 PID 5100 wrote to memory of 1068 5100 explorer.exe 106 PID 5100 wrote to memory of 1068 5100 explorer.exe 106 PID 5100 wrote to memory of 1068 5100 explorer.exe 106 PID 5100 wrote to memory of 3092 5100 explorer.exe 107 PID 5100 wrote to memory of 3092 5100 explorer.exe 107 PID 5100 wrote to memory of 3092 5100 explorer.exe 107 PID 5100 wrote to memory of 1056 5100 explorer.exe 108 PID 5100 wrote to memory of 1056 5100 explorer.exe 108 PID 5100 wrote to memory of 1056 5100 explorer.exe 108 PID 5100 wrote to memory of 920 5100 explorer.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3660
-
-
C:\Users\Admin\AppData\Local\Temp\b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4d7796140279c04e2366df7cd8dfa6c_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3572 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4640 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3888 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4636
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1008 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2304
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2052 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3088 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5024 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4604 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4520
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:232
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2572 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3316
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4480
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2320 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3008
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4676 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1132 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5036 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:376
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4608 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4280
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2904 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5044
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4084
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1004 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4980 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2636
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2208
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3092 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3044
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:116 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3056 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4160
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4072 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1884
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4908
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1880
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2652
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1616 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2116 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2264 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4964
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4948 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2504
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4672
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1204
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1816 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4764
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3668 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4816
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3048 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2912 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2804 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:884
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2624 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:860 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1660
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3832 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1692
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2480 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4896
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4488 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3636
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1576 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:856
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2360
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4992 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:968
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1112
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1968
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2920
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3128
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4420
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1972
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4484 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2180
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2892
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:2488 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3512
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2836
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2664
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1456
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3664
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:1864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2476
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1100
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1952 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4756
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3772
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4876
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2472
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4536
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3052
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3880
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:868
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1988
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2992
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4772
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2852
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4812
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1732
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4996
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3252
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3312
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2596
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD57a3c86629f551823f09a72433809f13f
SHA1ddfc0137b2efde09917c9a9b8550e84199ce4e47
SHA256e904491dc721d9d8d341869cd8e5b7c7a6e33f8d9fd0d34a7e2af95fb0d86607
SHA5125e0c2549523d26503b7c0ba4dd82d5e27c4abef1378fe9c47315b73f603d1f568bc9b81fd337276f2375c11e23e1303ae63ecd324cc3a8b2a2f854228e63b22d
-
Filesize
2.2MB
MD54325074a289a270badc54d8629b21f98
SHA1b8276c1634c684237685571813e39e7bdbbf3d07
SHA256833440800c053eeae3eccc10b9f9729f46b013e8d6d93d4ed6a28a298378c783
SHA5120b4cdc66bc1a0b5cd57e191c929c361cba1430032019a45a5e88e7720ab5ae78959c6529bb90c2d7b937ea3edea5acc0583f65592158c8e30b2b6f82f1ffec85