Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2024 15:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe
-
Size
220KB
-
MD5
f29041f6e122db95eb9aa73bdca6f33b
-
SHA1
bec0d6debe6db7ee7a1e3e082b29be19ca07f7ba
-
SHA256
80217594124052fa83eecb318222c6c813bdd2a32c89f2bf16c886a64156d89b
-
SHA512
96268b0773ebc0e5815d5540dd786739bc7c2aac4d8ca5536299b1f63db11c42d9a2a408e3fd59850fcb920bec2d5808db31399895ec4b106b69623ebc0166bb
-
SSDEEP
3072:0weV9Lijj7mOptxmwgI7KGoiBVQr5/9FUyJxaS76UeR6GP:0we4mwgIASVEzJsx7P
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wmpdnc32.exe -
Deletes itself 1 IoCs
pid Process 2764 wmpdnc32.exe -
Executes dropped EXE 32 IoCs
pid Process 4820 wmpdnc32.exe 2764 wmpdnc32.exe 3916 wmpdnc32.exe 220 wmpdnc32.exe 3728 wmpdnc32.exe 1180 wmpdnc32.exe 3564 wmpdnc32.exe 1308 wmpdnc32.exe 1096 wmpdnc32.exe 5008 wmpdnc32.exe 2436 wmpdnc32.exe 3924 wmpdnc32.exe 60 wmpdnc32.exe 3888 wmpdnc32.exe 3688 wmpdnc32.exe 2648 wmpdnc32.exe 5044 wmpdnc32.exe 3116 wmpdnc32.exe 3864 wmpdnc32.exe 952 wmpdnc32.exe 1512 wmpdnc32.exe 1412 wmpdnc32.exe 3592 wmpdnc32.exe 1084 wmpdnc32.exe 212 wmpdnc32.exe 4716 wmpdnc32.exe 640 wmpdnc32.exe 4944 wmpdnc32.exe 2088 wmpdnc32.exe 2036 wmpdnc32.exe 4556 wmpdnc32.exe 1096 wmpdnc32.exe -
Maps connected drives based on registry 3 TTPs 34 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdnc32.exe -
Drops file in System32 directory 48 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File created C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdnc32.exe File opened for modification C:\Windows\SysWOW64\wmpdnc32.exe wmpdnc32.exe -
Suspicious use of SetThreadContext 17 IoCs
description pid Process procid_target PID 4000 set thread context of 1712 4000 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 82 PID 4820 set thread context of 2764 4820 wmpdnc32.exe 89 PID 3916 set thread context of 220 3916 wmpdnc32.exe 93 PID 3728 set thread context of 1180 3728 wmpdnc32.exe 95 PID 3564 set thread context of 1308 3564 wmpdnc32.exe 99 PID 1096 set thread context of 5008 1096 wmpdnc32.exe 101 PID 2436 set thread context of 3924 2436 wmpdnc32.exe 103 PID 60 set thread context of 3888 60 wmpdnc32.exe 105 PID 3688 set thread context of 2648 3688 wmpdnc32.exe 107 PID 5044 set thread context of 3116 5044 wmpdnc32.exe 109 PID 3864 set thread context of 952 3864 wmpdnc32.exe 111 PID 1512 set thread context of 1412 1512 wmpdnc32.exe 113 PID 3592 set thread context of 1084 3592 wmpdnc32.exe 115 PID 212 set thread context of 4716 212 wmpdnc32.exe 117 PID 640 set thread context of 4944 640 wmpdnc32.exe 119 PID 2088 set thread context of 2036 2088 wmpdnc32.exe 121 PID 4556 set thread context of 1096 4556 wmpdnc32.exe 123 -
resource yara_rule behavioral2/memory/1712-0-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1712-2-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1712-3-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1712-4-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1712-31-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2764-43-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1712-47-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2764-48-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2764-57-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/220-56-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/220-60-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/220-65-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1180-71-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1180-74-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1308-79-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1308-82-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/5008-88-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3924-91-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3924-92-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3924-96-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3924-99-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3888-104-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3888-107-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2648-113-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2648-116-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3116-121-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/952-129-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/952-133-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1412-137-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1084-146-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1084-150-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4716-155-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4716-160-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4944-164-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4944-169-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2036-173-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2036-178-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 33 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdnc32.exe -
Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdnc32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1712 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 1712 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 1712 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 1712 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 2764 wmpdnc32.exe 2764 wmpdnc32.exe 2764 wmpdnc32.exe 2764 wmpdnc32.exe 220 wmpdnc32.exe 220 wmpdnc32.exe 220 wmpdnc32.exe 220 wmpdnc32.exe 1180 wmpdnc32.exe 1180 wmpdnc32.exe 1180 wmpdnc32.exe 1180 wmpdnc32.exe 1308 wmpdnc32.exe 1308 wmpdnc32.exe 1308 wmpdnc32.exe 1308 wmpdnc32.exe 5008 wmpdnc32.exe 5008 wmpdnc32.exe 5008 wmpdnc32.exe 5008 wmpdnc32.exe 3924 wmpdnc32.exe 3924 wmpdnc32.exe 3924 wmpdnc32.exe 3924 wmpdnc32.exe 3888 wmpdnc32.exe 3888 wmpdnc32.exe 3888 wmpdnc32.exe 3888 wmpdnc32.exe 2648 wmpdnc32.exe 2648 wmpdnc32.exe 2648 wmpdnc32.exe 2648 wmpdnc32.exe 3116 wmpdnc32.exe 3116 wmpdnc32.exe 3116 wmpdnc32.exe 3116 wmpdnc32.exe 952 wmpdnc32.exe 952 wmpdnc32.exe 952 wmpdnc32.exe 952 wmpdnc32.exe 1412 wmpdnc32.exe 1412 wmpdnc32.exe 1412 wmpdnc32.exe 1412 wmpdnc32.exe 1084 wmpdnc32.exe 1084 wmpdnc32.exe 1084 wmpdnc32.exe 1084 wmpdnc32.exe 4716 wmpdnc32.exe 4716 wmpdnc32.exe 4716 wmpdnc32.exe 4716 wmpdnc32.exe 4944 wmpdnc32.exe 4944 wmpdnc32.exe 4944 wmpdnc32.exe 4944 wmpdnc32.exe 2036 wmpdnc32.exe 2036 wmpdnc32.exe 2036 wmpdnc32.exe 2036 wmpdnc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4000 wrote to memory of 1712 4000 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 82 PID 4000 wrote to memory of 1712 4000 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 82 PID 4000 wrote to memory of 1712 4000 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 82 PID 4000 wrote to memory of 1712 4000 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 82 PID 4000 wrote to memory of 1712 4000 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 82 PID 4000 wrote to memory of 1712 4000 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 82 PID 4000 wrote to memory of 1712 4000 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 82 PID 1712 wrote to memory of 4820 1712 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 88 PID 1712 wrote to memory of 4820 1712 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 88 PID 1712 wrote to memory of 4820 1712 f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe 88 PID 4820 wrote to memory of 2764 4820 wmpdnc32.exe 89 PID 4820 wrote to memory of 2764 4820 wmpdnc32.exe 89 PID 4820 wrote to memory of 2764 4820 wmpdnc32.exe 89 PID 4820 wrote to memory of 2764 4820 wmpdnc32.exe 89 PID 4820 wrote to memory of 2764 4820 wmpdnc32.exe 89 PID 4820 wrote to memory of 2764 4820 wmpdnc32.exe 89 PID 4820 wrote to memory of 2764 4820 wmpdnc32.exe 89 PID 2764 wrote to memory of 3916 2764 wmpdnc32.exe 92 PID 2764 wrote to memory of 3916 2764 wmpdnc32.exe 92 PID 2764 wrote to memory of 3916 2764 wmpdnc32.exe 92 PID 3916 wrote to memory of 220 3916 wmpdnc32.exe 93 PID 3916 wrote to memory of 220 3916 wmpdnc32.exe 93 PID 3916 wrote to memory of 220 3916 wmpdnc32.exe 93 PID 3916 wrote to memory of 220 3916 wmpdnc32.exe 93 PID 3916 wrote to memory of 220 3916 wmpdnc32.exe 93 PID 3916 wrote to memory of 220 3916 wmpdnc32.exe 93 PID 3916 wrote to memory of 220 3916 wmpdnc32.exe 93 PID 220 wrote to memory of 3728 220 wmpdnc32.exe 94 PID 220 wrote to memory of 3728 220 wmpdnc32.exe 94 PID 220 wrote to memory of 3728 220 wmpdnc32.exe 94 PID 3728 wrote to memory of 1180 3728 wmpdnc32.exe 95 PID 3728 wrote to memory of 1180 3728 wmpdnc32.exe 95 PID 3728 wrote to memory of 1180 3728 wmpdnc32.exe 95 PID 3728 wrote to memory of 1180 3728 wmpdnc32.exe 95 PID 3728 wrote to memory of 1180 3728 wmpdnc32.exe 95 PID 3728 wrote to memory of 1180 3728 wmpdnc32.exe 95 PID 3728 wrote to memory of 1180 3728 wmpdnc32.exe 95 PID 1180 wrote to memory of 3564 1180 wmpdnc32.exe 98 PID 1180 wrote to memory of 3564 1180 wmpdnc32.exe 98 PID 1180 wrote to memory of 3564 1180 wmpdnc32.exe 98 PID 3564 wrote to memory of 1308 3564 wmpdnc32.exe 99 PID 3564 wrote to memory of 1308 3564 wmpdnc32.exe 99 PID 3564 wrote to memory of 1308 3564 wmpdnc32.exe 99 PID 3564 wrote to memory of 1308 3564 wmpdnc32.exe 99 PID 3564 wrote to memory of 1308 3564 wmpdnc32.exe 99 PID 3564 wrote to memory of 1308 3564 wmpdnc32.exe 99 PID 3564 wrote to memory of 1308 3564 wmpdnc32.exe 99 PID 1308 wrote to memory of 1096 1308 wmpdnc32.exe 100 PID 1308 wrote to memory of 1096 1308 wmpdnc32.exe 100 PID 1308 wrote to memory of 1096 1308 wmpdnc32.exe 100 PID 1096 wrote to memory of 5008 1096 wmpdnc32.exe 101 PID 1096 wrote to memory of 5008 1096 wmpdnc32.exe 101 PID 1096 wrote to memory of 5008 1096 wmpdnc32.exe 101 PID 1096 wrote to memory of 5008 1096 wmpdnc32.exe 101 PID 1096 wrote to memory of 5008 1096 wmpdnc32.exe 101 PID 1096 wrote to memory of 5008 1096 wmpdnc32.exe 101 PID 1096 wrote to memory of 5008 1096 wmpdnc32.exe 101 PID 5008 wrote to memory of 2436 5008 wmpdnc32.exe 102 PID 5008 wrote to memory of 2436 5008 wmpdnc32.exe 102 PID 5008 wrote to memory of 2436 5008 wmpdnc32.exe 102 PID 2436 wrote to memory of 3924 2436 wmpdnc32.exe 103 PID 2436 wrote to memory of 3924 2436 wmpdnc32.exe 103 PID 2436 wrote to memory of 3924 2436 wmpdnc32.exe 103 PID 2436 wrote to memory of 3924 2436 wmpdnc32.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f29041f6e122db95eb9aa73bdca6f33b_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Users\Admin\AppData\Local\Temp\F29041~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Users\Admin\AppData\Local\Temp\F29041~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3924 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:60 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3888 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3688 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2648 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5044 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3116 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3864 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:952 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1412 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3592 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1084 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:212 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4716 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:640 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4944 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2036 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4556 -
C:\Windows\SysWOW64\wmpdnc32.exe"C:\Windows\system32\wmpdnc32.exe" C:\Windows\SysWOW64\wmpdnc32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:1096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD5f29041f6e122db95eb9aa73bdca6f33b
SHA1bec0d6debe6db7ee7a1e3e082b29be19ca07f7ba
SHA25680217594124052fa83eecb318222c6c813bdd2a32c89f2bf16c886a64156d89b
SHA51296268b0773ebc0e5815d5540dd786739bc7c2aac4d8ca5536299b1f63db11c42d9a2a408e3fd59850fcb920bec2d5808db31399895ec4b106b69623ebc0166bb